A reflected cross-site scripting (XSS) vulnerability exists in Tileserver-gl versions <3.1.0. An attacker can exploit this vulnerability by sending a maliciously crafted URL to the victim. The malicious URL contains a malicious script that is executed in the victim's browser when the URL is accessed. The malicious script can be used to steal the victim's session information or to perform other malicious activities.