The Twisted framework's redirectTo function generates an HTTP 302 redirect response containing an HTML body that reflects the redirect URL without output encoding. If an attacker can control the redirect URL (e.g., via an open redirect in application code), they can inject arbitrary HTML/JavaScript, resulting in reflected XSS. This vulnerability is tracked as CVE-2024-41810. It is exploitable primarily in Firefox browsers, which render the HTML body, while other browsers do not. The vulnerability affects Twisted versions >=2.9.0 and <2.11.2_3. A proof of concept demonstrates the injection of a script alert via a crafted URL parameter. The issue is known to maintainers and a patch is available.

Successful exploitation allows execution of arbitrary JavaScript in the context of the victim's browser session, potentially enabling unauthorized access or modification of user data and unauthorized actions within the victim's session. The impact is limited to browsers that render the injected HTML body in the redirect response, notably Firefox. Other browsers reject or do not render the injected content, reducing the attack surface.

A patch is available for this vulnerability and should be applied to affected versions. The vendor advisory confirms the issue and the availability of a fix. If upgrading immediately is not possible, ensure that application code does not allow untrusted input to control redirect URLs to prevent exploitation. Note that the vulnerability is only exploitable in Firefox due to its handling of redirect responses.