CVE-2023-40024

CVE-2023-40024 is a Cross-Site Scripting (XSS) vulnerability affecting nexb scancode.io versions prior to 32.5.2. An attacker can inject malicious scripts into the /license/ endpoint by manipulating the detailed view key, which is not properly validated. This medium-severity vulnerability (CVSS 6.1) can lead to unauthorized actions, session hijacking, or sensitive information theft if an unsuspecting user visits the compromised page. There is no evidence of active exploitation, public exploit code, or significant community discussion, and users are advised to upgrade to version 32.5.2 immediately as no workarounds exist.