{"action":"Upgrade salvo to 0.88.1 or later.","affected":[{"fixed":"0.88.1","introduced":"0"}],"component":"salvo","cve_ids":["CVE-2026-22256"],"ecosystem":"crates.io","epss":0.00334,"exploited":false,"fixed_versions":["0.88.1"],"ghsa_id":"GHSA-rjf8-2wcw-f6mp","id":"tcs_01M5KF34648DVNYT2V2SY8FGTM","modified_at":"2026-02-03T03:15:26.215442Z","published_at":"2026-01-08T21:22:18Z","references":["https://osv.dev/vulnerability/GHSA-rjf8-2wcw-f6mp","https://github.com/salvo-rs/salvo/security/advisories/GHSA-rjf8-2wcw-f6mp","https://nvd.nist.gov/vuln/detail/CVE-2026-22256","https://github.com/salvo-rs/salvo","https://github.com/salvo-rs/salvo/blob/16efeba312a274739606ce76366d921768628654/crates/serve-static/src/dir.rs#L593"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-rjf8-2wcw-f6mp","url":"https://osv.dev/vulnerability/GHSA-rjf8-2wcw-f6mp"}],"summary":"Salvo is vulnerable to reflected XSS in the list_html function"}