Salvo, a Rust web backend framework, contains a reflected XSS flaw in the list_html function in all releases prior to 0.88.1. The function generates a file listing page that inserts the request path directly into the HTML without sanitization. An attacker can craft a URL with malicious JavaScript embedded in the path; when the server normalises the path during matching and renders it in the page, the payload executes in the victim’s browser. This flaw enables attackers to compromise user confidentiality and integrity, potentially hijacking sessions or stealing information, and is classified as CWE‑79.

All deployments of salvo-rs:salvo running any version earlier than 0.88.1 that expose a directory listing via list_html (such as a publicly reachable /files path containing at least one subdirectory).

The vulnerability scores a CVSS of 8.8, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of widespread exploitation, and it is not yet listed in the CISA KEV catalog. However, the flaw is exploitable without authentication; an attacker only needs to direct a web user to a specially crafted URL to trigger script execution. The only requirement is that the vulnerable route be accessible, making the attack broadly feasible on affected installations.