[CodeQL #48] Reflected server-side cross-site scripting

[devin-ai-integration]

CodeQL Alert #48: Reflected server-side cross-site scripting

Field	Value
Rule ID	py/reflective-xss
Severity	MEDIUM
File path	vulnerable_xss.py
Line range	Lines 54–54
CWE category	CWE-079, CWE-116
Classification	demo-only
Priority tier	batched
Alert link	View CodeQL Alert

Code Snippet

def error_page():
    error_msg = request.args.get('msg')
    
    return f"<div class='error'>{error_msg}</div>"

@app.route('/dashboard')
def dashboard():

Classification: demo-only

This file is prefixed with vulnerable_ and is an intentionally insecure demo file for CodeQL demonstration purposes.

---

Generated by automated security triage on 2026-03-25.

[devin-ai-integration]

**Classification: **\n\nThis alert is in , which is an intentionally insecure demo file (prefixed with ). No fix required — closing as not planned.