An unauthenticated reflected cross-site scripting vulnerability in the Salvo framework allows attackers to execute malicious scripts in the context of a user session.

The vulnerability exists in the list_html function, which improperly sanitizes the current path when generating HTML directory views. This allows an unauthenticated attacker to trigger reflected XSS by crafting a request path that is rendered raw within the HTML output.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the user. With a CVSS score of 8.8, this flaw represents a high risk to application integrity and user security, as it bypasses standard input validation mechanisms.

Immediate Action: Update the Salvo framework to version 0.88.1 or later to implement the necessary input sanitization fixes.

Proactive Monitoring: Review web server and application access logs for unusual URL structures or encoded characters that may indicate attempts to probe for path-based XSS injection.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts, and utilize a Web Application Firewall (WAF) to filter malicious input patterns in incoming HTTP requests.

Public Exploit Available: Unknown.

Given the high CVSS severity and the presence of a proof-of-concept, organizations using the Salvo framework must prioritize updating to version 0.88.1. Failure to patch leaves applications susceptible to XSS attacks that could compromise sensitive user data and session integrity.