Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Alist v2.1.0 and below was discovered to contain a cross-site scripting XSS vulnerability via /i/:data/ipa.plist...