CVE-2026-66603: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in David Artiss Draft List

The vulnerability identified as CVE-2026-66603 in the David Artiss Draft List simple-draft-list component is a stored cross-site scripting (XSS) flaw. It arises from improper neutralization of input during web page generation, which can allow an attacker with low privileges and requiring user interaction to execute scripts in the context of the affected web application. This vulnerability affects versions up to 2.6.4. No patch or remediation information is provided in the available data.

Successful exploitation of this vulnerability could lead to partial confidentiality, integrity, and availability impacts, as indicated by the CVSS vector (C:L/I:L/A:L). An attacker could execute malicious scripts in the context of the affected application, potentially leading to session hijacking, data manipulation, or denial of service conditions. However, exploitation requires user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing input validation or output encoding as temporary mitigations.