Executive brief
Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names
Affected products
- crates.io salvo
Junglewise Threat Intelligence
CVE-2026-22257: Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names
CVE-2026-22257 · Severity: low · CVSS 3.1 · Published 2026-01-08
Technologies: salvo (crates.io). Vendors: crates.io.