A stored cross-site scripting issue exists in the tag rendering code. Several client-side rendering paths interpolate tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. An attacker capable of creating or influencing stored tag or metadata values can inject a crafted payload. When a victim views affected BSimVis pages, the payload executes arbitrary JavaScript in their session, potentially allowing the attacker to perform actions as the victim, read available data, or alter application content.