Greenshift EUVD-2026-91240

Exploitation requires a non-default content configuration: a site administrator must have previously set a Greenshift element block's Custom JS field to include a '{{GET:...}}' dynamic placeholder, and that JS must contain the token 'import', which routes the attacker-controlled GET value into an unescaped raw echo inside a <script type="module"> tag. Given that, an unauthenticated remote attacker (PR:N) can inject script, but success also requires victim user interaction (UI:R) - the victim must click an attacker-crafted link. Sites that do not use {{GET:}} placeholders in Custom JS, or whose Custom JS lacks the 'import' token, are not exploitable, so the realistic exposed population is a subset of installs on Greenshift ≤13.2.0.

This is a moderate-severity reflected XSS (CWE-79) with a conflicting-signal profile that places it well below the priority of a typical 'network, unauthenticated' critical. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) reflects a remote unauthenticated attacker, but exploitation is not against a default install: per the description it only works when a site administrator has already configured an element block's Custom JS field to embed a {{GET:...}} placeholder AND that JS contains the token 'import', which forces the value into an unescaped raw echo inside a <script type="module"> tag. That precondition is the dominant real-world risk limiter and arguably warrants higher attack complexity than the AC:L in the supplied vector - a point worth verifying, as the config dependency makes affected sites a small subset of all installs. No EPSS score, KEV entry, or POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' UI:R further requires tricking a victim into clicking a crafted link. Net: a real but conditional, low-complexity-to-weaponize-once-configured issue that should be patched on a normal cadence, not an emergency, absent evidence of active exploitation.

On a site where an administrator has configured a Greenshift element block's Custom JS to use a {{GET:...}} placeholder with JavaScript containing the 'import' keyword, an attacker crafts a URL with a malicious value in the targeted GET parameter and lures a victim into clicking it. The unsanitized value is reflected into a <script type="module"> block and executes in the victim's browser session. No public exploit code was identified in the provided data.