The HTML and RSS output handlers in dosage (dosagelib/events.py) write unescaped user-controlled content (comic text and page URLs) directly into generated files. The BasicScraper.fetchText() method calls html.unescape() on extracted text, but no subsequent escaping or sanitization occurs before writing to HTML or RSS output. This results in stored XSS where malicious JavaScript embedded in comic text or URLs executes when the generated files are opened. The vulnerability affects dosage versions prior to 3.3.

An attacker who can supply malicious comic text or URLs can inject JavaScript into the generated HTML or RSS files. When a user opens these files in a browser, the malicious script executes, potentially leading to theft of cookies or other sensitive information. The vulnerability impacts confidentiality and integrity by enabling cross-site scripting attacks. There is no indication of denial of service or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening HTML or RSS files generated by vulnerable dosage versions with untrusted content. Applying proper HTML escaping or sanitization to all user-controlled content before writing to output files is necessary to prevent exploitation.