Rate Moderate - exploitation requires an authenticated user with the collection-namespace owner role to store the payload (roleless upload is rejected), and a separate authenticated viewer must actively activate the crafted link (no execution on page load); the build CSP does not block the script-executing scheme. Component mapping confirmed via newcli: Platform UI assets ship in automation-gateway (2.5 RPM), automation-platform-ui (2.6 RPM), and the gateway-rhel9 container (2.6 and 2.7); standalone ansible-hub-ui uses a different, non-reproduced renderer. Source flaw component = upstream ansible-ui (frontend/hub).