Reflected Cross-Site Scripting in Flight Micro-Framework for PHP

CVE-2026-42548

What is CVE-2026-42548?

The Flight micro-framework for PHP has a vulnerability that arises from improper handling of the ?jsonp= query parameter in versions prior to 3.18.1. Specifically, the Flight::jsonp() function directly inserts this value into an application/javascript response body without validating it as a legitimate JavaScript identifier. This lack of validation allows attackers to inject malicious JavaScript, which may be executed in the context of the response's origin, leading to reflected cross-site scripting attacks that can compromise user information and application integrity. The issue has been addressed in version 3.18.1.

References