A callback name can become executable input

A JSONP response is JavaScript: the server wraps a JSON payload in a caller-named function invocation and returns it as a script. The JSON body can be encoded safely, but the callback name sits outside that body, and it is the part a browser will execute. The security boundary is therefore the callback name, not the data.

The upstream advisory records a reflected cross-site-scripting issue in the API for versions up to 1.10.2. The endpoint copied a request-supplied callback into the response and concatenated it into the script without constraining it to a function identifier.

The API entry point copied either the callback or the jsonp request parameter into the response model with no validation, so any string was retained. The formatter then built the body by placing that string ahead of the JSON-encoded payload, opening a parenthesis, and serving the result as application/javascript.

Because the response is delivered as a script, an attacker page that loads the endpoint through a script element runs the reflected code in the shortener’s origin. The impact is not a harmless dialog: code executes as whatever user visits the attacker page, including a signed-in administrator. Public API mode allows this without authentication.

The upstream fix adds a validator that accepts only a safe identifier and returns false otherwise, and the formatter now runs the callback through it. An invalid callback produces a structured error response instead of a script, so a value carrying JavaScript operators can no longer reach the output.

The change also adds unit tests for the formatter. Moving the decision to the point of emission means every caller of the JSONP path inherits the same constraint, rather than relying on each entry point to sanitize its own input.

The repository advisory identifies 1.10.3 as patched and records a user-interaction requirement: a victim must load the attacker’s page. In public API mode the reflection needs no authentication. The linked public records assign a GHSA identifier and no identifier from the reviewed advisory database.

A regression check requests the JSONP endpoint with a callback that contains JavaScript operators and reads the raw response body. A patched build should return an error rather than a body that begins with the supplied operators. Verify the response content type and the leading bytes, since a browser that refuses to run malformed script can hide a reflection that is still present. The scenarios below are suggested review checks, not reported TraceMint test results.

For reviewers, JSON encoding secures the data object but says nothing about a callback concatenated around it. Any value that becomes part of an executable response—function names, template fragments, header-driven redirects—needs its own validation at the point of emission.

The public advisory credits the TraceMint account as reporter, alongside the maintainers who developed and verified the remediation; the original advisory holds the complete credit record. This study analyzes public records and immutable source; it does not claim sole discovery or access to any deployment.