CVE-2026-42548 is a reflected cross-site scripting vulnerability in the FlightPHP micro-framework core prior to version 3.18.1. The Flight::jsonp() method improperly concatenates the ?jsonp= query parameter directly into an application/javascript response without validating that the parameter value is a valid JavaScript identifier. This allows attackers to inject arbitrary JavaScript code that executes in the origin context of the response. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). It has a CVSS 4.0 score of 8.6, indicating high severity. The vulnerability is resolved in FlightPHP 3.18.1.

Successful exploitation of this vulnerability allows an attacker to perform reflected cross-site scripting attacks, leading to arbitrary JavaScript execution in the context of the affected web application. This can result in session hijacking, defacement, or other malicious actions executed by the victim's browser. The CVSS score of 8.6 reflects a high impact due to network attack vector, no privileges required, user interaction needed, and high impact on confidentiality and integrity.

A fix for this vulnerability is available in FlightPHP version 3.18.1. Users and administrators should upgrade to version 3.18.1 or later to remediate this issue. Since this is not a cloud service, patching the affected software is required to mitigate the risk. No vendor advisory content contradicts this; therefore, upgrading is the recommended action.