htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
{ "nvd_published_at": "2020-02-10T03:15:00Z", "github_reviewed_at": "2021-04-06T21:51:28Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [ "CWE-79" ] }