BaseFortify

Publication date: 2026-05-13

Last updated on: 2026-05-14

Assigner: GitHub, Inc.

Description

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. This vulnerability is fixed in 3.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-13

Last Modified

2026-05-14

Generated

2026-06-30

EPSS Evaluated

2026-06-28

NVD

CVE-2026-42548

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-42548. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70