Consul and Consul Enterprise versions from 1.4.1 up to but not including 1.20.0 are affected by a reflected cross-site scripting (XSS) vulnerability. This occurs because the server response does not explicitly set a Content-Type HTTP header, allowing user input to be misinterpreted and reflected in the response. The vulnerability has a medium severity rating and a patch is available to address the issue.