CVE-2026-42548
CVE-2026-42548 · Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. This vulnerability is fixed in 3.18.1.
CVSS 8.6 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
core
- Versions
- < 3.18.1: Affected
No fix published
flightphp/core Packagist
- Versions
- v1.0
- v1.1
- v1.1.10
- v1.1.5
- v1.2
- v1.2.13
- v1.2.14
- v1.2.15
- v1.2.17
- v1.2.18
- v1.2.19
- v1.2.20
- v1.2.21
- v1.2.22
- v1.3.0
- v1.3.1
- v1.3.2
- v1.3.3
- v1.3.4
- v1.3.5
- v1.3.7
- v1.3.8
- v1.3.9
- v2.0.0
- v2.0.1
- v3.0.0
- v3.0.1
- v3.0.2
- v3.1.0
- v3.1.1
- v3.10.0
- v3.10.1
- v3.11.0
- v3.11.1
- v3.12.0
- v3.13.0
- v3.13.1
- v3.14.0
- v3.15.0
- v3.15.1
- v3.15.2
- v3.15.3
- v3.16.0
- v3.16.1
- v3.17.0
- v3.17.1
- v3.17.2
- v3.17.3
- v3.17.4
- v3.18.0
- v3.2.0
- v3.3.0
- v3.4.0
- v3.4.1
- v3.4.2
- v3.5.0
- v3.5.2
- v3.5.3
- v3.6.0
- v3.6.1
- v3.6.2
- v3.7.0
- v3.7.1
- v3.7.2
- v3.8.0
- v3.8.1
- v3.9.0
- Affected ranges
- ECOSYSTEM: < 3.18.1
Update to 3.18.1