Flight, an extensible micro‑framework for PHP, contains a reflected cross‑site scripting flaw in its JSONP handling. The implementation concatenates the ?jsonp= query value directly into a JavaScript response without validating that it is a legal identifier, allowing an attacker to inject arbitrary code that executes in the context of the receiving browser. This can lead to session hijacking, credential theft, defacement, or other client‑side compromise. The weakness is classified as CWE‑79, reflected XSS.

The flaw affects the FlightPHP core micro‑framework for PHP. All versions released before 3.18.1 are vulnerable; fixes are included in release 3.18.1 and later. Users of older releases must verify their current version and plan a corrective change accordingly.

The CVSS score of 8.6 indicates a high severity vulnerability that can be exploited remotely. EPSS data is not available and the flaw is not listed in the KEV catalog, but the lack of protection allows an attacker to craft a URL with an arbitrary callback name (e.g., ?jsonp=alert(1)) that will run in any victim’s browser. Since no authentication is required and the payload can be embedded in a link, the exploitation path is trivially achievable for malicious actors or automated scanners.