CyberRota Analysis
AI-GeneratedThe built-in Debug plugin in Perspective 5.0.0 is vulnerable to cross-site scripting due to improper handling of unescaped HTML markup in table cell values, allowing attackers to inject arbitrary HTML and JavaScript. This vulnerability can lead to the execution of malicious scripts within the context of the embedding page's origin, potentially compromising user data and session integrity. Organizations using this version of Java should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization rendering. Attackers can craft table rows with payloads such as unquoted attribute injections containing event handler attributes that bypass RFC 4180 quoting, since angle brackets and event handler attributes are never escaped before assignment, causing malicious scripts to execute in the embedding page's origin.