A persistent cross-site scripting (XSS) vulnerability exists in @dependencytrack/frontend versions from 4.12.0 up to but not including 4.13.6. This flaw allows users with SYSTEM_CONFIGURATION permission to configure a welcome message containing unsanitized HTML, leading to arbitrary JavaScript execution on the login page. The vulnerability is fixed in version 4.13.6.