The NagVis component within Checkmk is vulnerable to reflected cross-site scripting (XSS). This vulnerability allows an attacker to craft a malicious link that executes arbitrary JavaScript in the victim's browser when clicked. Both authenticated and unauthenticated users can be targeted by this attack. The vulnerability has a medium severity rating with a CVSS score of 5.4.