Administrator privilege escalation via stored HTML scripts

Stored cross-site scripting in Apache CouchDB before 3.1.2 allows attackers to gain administrator privileges through HTML content. Attachment, _show, and _list responses serve attacker-controlled HTML without a protective Content-Security-Policy, so embedded JavaScript runs in the security context of an administrator who opens it. The attacker needs document-creation permission and administrator interaction; successful execution can add or remove database data or change configuration.