For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that signal.
CVSS 3.1MEDIUM 4.3·Network·High privileges·User interaction·EPSS 0.00394·Published 2024-04-02·Fixed in 2.25.0CWE-79
