An authenticated stored cross-site scripting vulnerability in BraveCMS allows malicious editor-role users to execute arbitrary code in visitors' browsers, compromising application integrity and user sessions.

This flaw involves CWE-79, Improper Neutralization of Input During Web Page Generation, where rich text input is rendered using unescaped output directives. The attack requires low privileges as an authenticated editor.

A successful exploit permits an attacker with editor-level access to persistently inject malicious scripts that execute within the context of any user visiting the affected page. This can lead to session hijacking, unauthorized actions on behalf of other users, and potential data theft. The CVSS score of 8.7 reflects the high severity of potential impacts on confidentiality and integrity.

Immediate Action: Update BraveCMS to commit 6c56603 or later where the input sanitization issue has been resolved.

Proactive Monitoring: Monitor content management system audit logs for suspicious article modifications or unusual script tags injected into page and article bodies.

Compensating Controls: Implement strict Content Security Policy headers to restrict script execution and mitigate the impact of potential cross-site scripting payloads.

Public Exploit Available: Yes, a published advisory and patch commit exist on GitHub detailing the vulnerability mechanism.

Given the high CVSS score of 8.7 and the ability to achieve stored script execution, administrators should prioritize applying the patch immediately. Restricting editor-level permissions to trusted personnel until the software is updated will help reduce the window of exposure.