A reflected Cross-Site Scripting (XSS) vulnerability exists in the /publix/run endpoint of JATOS versions 3.7.1 through 3.9.6. This flaw allows remote attackers to execute arbitrary JavaScript in the browser of an authenticated admin user by injecting malicious code into the "code" URL parameter. Successful exploitation can lead to unauthorized actions, account compromise, and privilege escalation within the affected application.