server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
CVSS 3.1MEDIUM 5.4·Network·Low privileges·User interaction·EPSS 0.85649·Published 2020-12-29·Fixed in 20.12.0CWE-79