evidence-artifact

This evidence-viewer code has a potential cross-site scripting issue in timeline(): unescaped event state and row-count values are interpolated into innerHTML and can inject markup if attacker-controlled. Image source values can trigger browser requests to supplied URLs, but the fragment contains no evident credential theft, command execution, or other malware behavior. Severity is medium and depends on the trustworthiness of the rendered data; no specific domains, IPs, file paths, or targeted credentials are present.