Eyelessgoddd

**Name of the Vulnerable Software and Affected Versions** Valhalla versions prior to 3.6.4 **Description** Reflected cross-site scripting (XSS) occurs due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, the value is reflected directly into the HTTP response body with Content-Type: application/javascript without validation, output encoding, or allowlist filtering. An attacker can craft a URL containing arbitrary JavaScript in the callback parameter; if a victim loads that URL via a script tag, the injected script executes in the context of the serving origin, potentially leading to session token theft, credential disclosure, or actions performed on behalf of the victim. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.