CVE-2026-42548: Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()

Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting.