CVE-2026-49294

Name of the Vulnerable Software and Affected Versions Valhalla versions prior to 3.6.4

Description Reflected cross-site scripting (XSS) occurs due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, the value is reflected directly into the HTTP response body with Content-Type: application/javascript without validation, output encoding, or allowlist filtering. An attacker can craft a URL containing arbitrary JavaScript in the callback parameter; if a victim loads that URL via a script tag, the injected script executes in the context of the serving origin, potentially leading to session token theft, credential disclosure, or actions performed on behalf of the victim.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.