tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')