The Twisted web framework's redirectTo function has an HTML injection vulnerability that can lead to reflected cross-site scripting (XSS) if an attacker controls the redirect URL. This occurs because the redirect URL is reflected in the HTML body of the HTTP 302 response without proper encoding. The vulnerability is exploitable primarily in Firefox browsers due to their handling of redirect responses. Successful exploitation allows execution of arbitrary JavaScript in the victim's session context, potentially leading to unauthorized access or actions. A fix is available in version 24.7.0rc1.