H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.
CVE ID: CVE-2023-6013
CVSS Base Severity: CRITICAL
CVSS Base Score: 9.3
Vendor: h2oai
Product: h2oai/h2o-3
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 23.09% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)