A stored cross-site scripting (XSS) vulnerability was present in the Vulnerability-Lookup application within the render_tag_badges Jinja filter. This flaw allowed authenticated users with permissions to create or modify vulnerability records to inject arbitrary HTML or JavaScript into reference tags. The injected code would be stored and later rendered without proper escaping on public vulnerability pages, potentially executing scripts in the context of any visitor's browser. The vulnerability was fixed by properly escaping user-supplied tags before rendering.