An unauthenticated Cross-site Scripting vulnerability in LinuxServer.io Heimdall allows attackers to execute malicious scripts in the context of a user session.

This is a Cross-site Scripting (CWE-79) vulnerability where the q parameter fails to properly neutralize input. The vulnerability is exploitable by an unauthenticated attacker, allowing for potential session hijacking or unauthorized actions if a user is tricked into interacting with a malicious link.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, which can lead to session theft, unauthorized data access, or the performance of actions on behalf of the authenticated user. Given the CVSS score of 7.2, this is a high-severity issue that could facilitate account compromise or lateral movement within the application environment.

Immediate Action: Upgrade to Heimdall version 2.7.3 or later immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Monitor web access logs for anomalous requests containing script tags or suspicious URL parameters targeting the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS patterns in URL parameters.

Public Exploit Available: No (A Nuclei detection template exists, but no weaponized exploit or public proof-of-concept is currently confirmed).

This vulnerability poses a significant risk due to its unauthenticated nature and potential for full session compromise. Administrators should prioritize updating to version 2.7.3 to eliminate the flaw. Until the update is applied, ensure that users are educated on the risks of clicking untrusted links, and utilize WAF protections to mitigate potential injection attempts.