CVE-2026-39683

CVE-2026-39683 is a DOM-based cross-site scripting (XSS) vulnerability in the Chief Gnome Garden Gnome Package version 2.4.1 and earlier that results from improper neutralization of user input during web page generation. This vulnerability could allow attackers to inject malicious scripts that execute in users' browsers within the context of the affected application. The vulnerability carries a CVSS score of 5.9 (Medium severity) with a network-based attack vector requiring high privileges and user interaction to exploit. The attack has limited scope and may result in confidentiality, integrity, and availability impacts. The EPSS score of 0.00033 indicates this vulnerability has minimal prevalence relative to other disclosed CVEs. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat watch lists. No public exploit code is currently known to be available. The relatively low community attention and risk scoring suggest this is a lower-priority concern for most organizations, though patching to versions beyond 2.4.1 is still recommended.