Mongoose versions prior to 7.22 contain a reflected cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the mg_http_serve_dir() and listdir() functions in src/http.c insert the decoded request URI into the title and h1 HTML elements without HTML entity encoding. An attacker can exploit this by sending a crafted percent-encoded request path to a deployment with MG_ENABLE_DIRLIST enabled, causing script execution in the victim's browser under the Mongoose origin. This vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) and was published on 2026-08-20. The vulnerability is fixed in version 7.22.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the vulnerable Mongoose web server origin. This can lead to exposure of session data or unauthorized actions performed as the victim user. The vulnerability does not require privileges or authentication but does require user interaction (UI:R). There is no indication of availability impact.

This vulnerability is fixed in Mongoose version 7.22. Users should upgrade to version 7.22 or later to remediate this issue. No other official remediation or temporary fixes are documented. Since this is not a cloud service, remediation depends on applying the vendor's fix.