AIKIDO-2026-334058

TL;DR

The base ExceptionHandler in the AdonisJS HTTP server renders error responses as HTML by interpolating error.message and validation message.field / message.message values directly into the markup without escaping. When an application serves HTML error responses in production and an error carries attacker-influenced content, such as a not-found route path or submitted validation field names, the raw values are reflected into the response body. A remote attacker can inject HTML or script that executes in the victim's browser, resulting in reflected cross-site scripting. The fix HTML-escapes the error message and validation field/message values before embedding them in the response.