CVE-2026-42548: FlightPHP Flight reflected XSS in Flight::jsonp callback

Executive brief

Flight is a micro-framework for PHP used to build web applications and APIs. A vulnerability in its JSONP handling allows attackers to inject malicious scripts into web pages. This could lead to unauthorized access to user sessions, theft of sensitive cookies, or the exposure of private API data.

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in the `Flight::jsonp()` method within `flight/Engine.php`. The framework concatenates the `jsonp` query parameter directly into the `application/javascript` response body without validating it as a legal JavaScript identifier. A remote attacker can provide a malicious payload in the query string that, when executed in the context of the victim's browser, can steal session cookies or exfiltrate authenticated API responses. The issue is fixed in version 3.18.1 by implementing a regex validation (`^[A-Za-z_$][\w$.]{0,127} ) for the callback name.

Affected products

• flightphp core < 3.18.1

Timeline

• 2026-04-29: disclosed: Initial disclosure in flightphp/core repository
• 2026-05-06: advisory: GitHub Advisory published
• 2026-05-13: other: NVD publication date

References

• https://api.github.com/users/Rootingg
• https://github.com/Rootingg
• https://api.github.com/users/Rootingg/gists%7B/gist_id%7D
• https://api.github.com/users/Rootingg/repos
• https://avatars.githubusercontent.com/u/91620858?v=4
• https://api.github.com/users/Rootingg/events%7B/privacy%7D