A reflected cross-site scripting (XSS) flaw was found in Quay's v1 registry API. The util/http.py _abort() helper builds error bodies with json.dumps() without setting a Content-Type, so Flask serves them as text/html. The v1 image endpoints (endpoints/v1/registry.py) interpolate the attacker-controlled image_id URL path segment into the 404 error message, and json.dumps does not escape angle brackets. An unauthenticated attacker can craft a URL that, when visited by a logged-in Quay user, executes arbitrary JavaScript in the registry origin, which is shared with the Quay web UI and API. Exploitation requires the victim's browser to first establish a v1 session cookie on a public repository (anonymous access is enabled by default), which an attacker page can chain via successive navigations. Confirmed in Quay 3.18.2; util/http.py is unchanged in current upstream main.