This vulnerability in stonith404 pingvin-share (up to version 1.13.0) involves a cross-site scripting flaw in the getServerSideProps function of the Sign-in Auto-Redirect component (frontend/src/pages/auth/signIn.tsx). Manipulation of the redirect parameter enables injection of malicious scripts, which can be executed in the context of the victim's browser. The vulnerability is remotely exploitable without privileges or user interaction beyond visiting a crafted link. Although the exploit is publicly available, no official fix or patch has been released by the vendor as of the publication date.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application for users who interact with the manipulated redirect parameter. This can lead to session hijacking, credential theft, or other malicious actions performed on behalf of the victim. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate risk. There is no indication of privilege escalation or direct system compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider implementing temporary mitigations such as input validation or sanitization on the redirect parameter, or disabling the vulnerable component if feasible. Monitor official vendor channels for updates or patches.