CVE-2026-42548

Name of the Vulnerable Software and Affected Versions Flight versions prior to 3.18.1

Description The Flight::jsonp() function concatenates the jsonp query parameter directly into an application/javascript response body without validating if the value is a legal JavaScript identifier. This allows an attacker to inject arbitrary JavaScript that executes in the response origin, leading to reflected cross-site scripting (XSS), which can result in cookie theft, session hijacking, or exfiltration of authenticated API responses.

Recommendations Update to version 3.18.1.