CVE-2026-22256 Salvo is vulnerable to reflected XSS in the list_html function
Attackers can execute arbitrary scripts in victim browsers via reflected XSS in the Salvo Rust web framework's file listing feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-22256?
CVE-2026-22256 is a high-severity cross-site scripting vulnerability in salvo-rs salvo, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generate an file view of a folder which include a render of the current path, in which its inserted in the HTML without proper sanitation, this leads to reflected XSS using the fact that request path is decoded and normalized in the matching stage but not is inserted raw in the html view (current.path), the only constraint here is for the root path (eg. /files in the PoC example) to have a sub directory (e.g common ones styles/scripts/etc…) so that the matching return the list HTML page instead of the Not Found page. This issue has been patched in version 0.88.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-22256?
2 open source packages ship an affected version, including salvo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
salvo crates.io | All versions | 0.88.1 |
salvo crates.io | All versions | 0.88.1 |
Products include Salvo Salvo.
How do I fix CVE-2026-22256?
Upgrade salvo to 0.88.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-22256 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22256 exists.
Other vulnerabilities in salvo-rs salvo
- CVE-2026-22257 Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names
- CVE-2026-33241 Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing
- CVE-2026-33242 Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass
Sources
Also known as GHSA-rjf8-2wcw-f6mp.