This vulnerability (CWE-79) affects Nexcess Virtue/Ascend/Pinnacle Toolkit versions up to and including 4.9.12.1. It is a contributor cross-site scripting (XSS) flaw where input is not properly sanitized during web page generation, enabling an attacker with low privileges and requiring user interaction to execute scripts that could impact confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope changed, and partial impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with limited privileges to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The vulnerability requires user interaction and privileges, limiting its impact compared to more severe XSS flaws.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting user privileges and educating users about the risks of interacting with untrusted content.