Administrator takeover via unescaped SVG color substitution

Reflected XSS in Arcane before 1.19.0 allows remote attackers to execute script in its origin via a crafted logo color URL. The unauthenticated /api/app-images/logo handler inserts the color query value into logo.svg with strings.ReplaceAll and no escaping, so input can close the style element and add a script element. Exploitation requires an authenticated administrator to visit the crafted URL; the script then uses the victim's automatically attached HttpOnly JWT cookie to create an attacker-controlled administrator account and access managed Docker resources.