CVE-2026-66296 (GCVE-0-2026-66296)
Vulnerability from cvelistv5 – Published: 2026-08-03 19:04 – Updated: 2026-08-03 19:50
VLAI
EPSS
VEX
Title
Reflected XSS in oaskit's default HTML error handler
Summary
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler.
Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 in lib/oaskit/error_handler/default.ex render request-validation failures as an HTML page whenever the request's Accept header contains html, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or deepObject query parameter, which appear in the JSON Schema error's instance path when a schema rejects them (for example under additionalProperties: false), and the raw Content-Type header, reflected in unsupported-media-type errors when it fails to parse.
Because browsers send Accept: text/html on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom Content-Type, or attacker-controlled script on the victim's side is required. A payload such as filter[</code></h2><script>alert(document.domain)</script>]=x terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin's cookies, session, and same-origin responses.
Both HTML error rendering and the vulnerable handler are enabled by default: Oaskit.Plugs.ValidateRequest defaults :html_errors to true and :error_handler to Oaskit.ErrorHandler.Default, so applications following the documented usage are affected without any opt-in.
This issue affects oaskit: from 0.1.0 before 0.14.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 19:50 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/lud/oaskit/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-66296.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-66296 | related |
| https://github.com/lud/oaskit/commit/b70c6b2eaf0b… | patch |
Impacted products
Date Public
2026-07-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66296",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:50:03.665445Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:50:27.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:lud:oaskit:*:*:*:*:*:elixir:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Oaskit.ErrorHandler.Default"
],
"packageName": "oaskit",
"packageURL": "pkg:hex/oaskit",
"product": "oaskit",
"programFiles": [
"lib/oaskit/error_handler/default.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:format_reason/4"
},
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:reason_to_html/1"
}
],
"repo": "https://github.com/lud/oaskit",
"vendor": "lud",
"versions": [
{
"lessThan": "0.14.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:lud:oaskit:*:*:*:*:*:elixir:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Oaskit.ErrorHandler.Default"
],
"packageName": "lud/oaskit",
"packageURL": "pkg:github/lud/oaskit",
"product": "oaskit",
"programFiles": [
"lib/oaskit/error_handler/default.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:format_reason/4"
},
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:reason_to_html/1"
}
],
"repo": "https://github.com/lud/oaskit",
"vendor": "lud",
"versions": [
{
"lessThan": "b70c6b2eaf0b11bdd0bbb21b8a87dbb3d46918a1",
"status": "affected",
"version": "552de8ca0ff60617bea58bcafa451892d61a161c",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lud:oaskit:*:*:*:*:*:elixir:*:*",
"versionEndExcluding": "0.14.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ludovic Dem"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ludovic Dem"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"datePublic": "2026-07-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eOaskit.ErrorHandler.Default.format_reason/4\u003c/code\u003e and \u003ccode\u003eOaskit.ErrorHandler.Default.reason_to_html/1\u003c/code\u003e in \u003ccode\u003elib/oaskit/error_handler/default.ex\u003c/code\u003e render request-validation failures as an HTML page whenever the request\u0027s \u003ccode\u003eAccept\u003c/code\u003e header contains \u003ccode\u003ehtml\u003c/code\u003e, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or \u003ccode\u003edeepObject\u003c/code\u003e query parameter, which appear in the JSON Schema error\u0027s instance path when a schema rejects them (for example under \u003ccode\u003eadditionalProperties: false\u003c/code\u003e), and the raw \u003ccode\u003eContent-Type\u003c/code\u003e header, reflected in unsupported-media-type errors when it fails to parse.\u003c/p\u003e\n\u003cp\u003eBecause browsers send \u003ccode\u003eAccept: text/html\u003c/code\u003e on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom \u003ccode\u003eContent-Type\u003c/code\u003e, or attacker-controlled script on the victim\u0027s side is required. A payload such as \u003ccode\u003efilter[\u0026lt;/code\u0026gt;\u0026lt;/h2\u0026gt;\u0026lt;script\u0026gt;alert(document.domain)\u0026lt;/script\u0026gt;]=x\u003c/code\u003e terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin\u0027s cookies, session, and same-origin responses.\u003c/p\u003e\n\u003cp\u003eBoth HTML error rendering and the vulnerable handler are enabled by default: \u003ccode\u003eOaskit.Plugs.ValidateRequest\u003c/code\u003e defaults \u003ccode\u003e:html_errors\u003c/code\u003e to \u003ccode\u003etrue\u003c/code\u003e and \u003ccode\u003e:error_handler\u003c/code\u003e to \u003ccode\u003eOaskit.ErrorHandler.Default\u003c/code\u003e, so applications following the documented usage are affected without any opt-in.\u003c/p\u003e\n\u003cp\u003eThis issue affects oaskit: from 0.1.0 before 0.14.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler.\n\n`Oaskit.ErrorHandler.Default.format_reason/4` and `Oaskit.ErrorHandler.Default.reason_to_html/1` in `lib/oaskit/error_handler/default.ex` render request-validation failures as an HTML page whenever the request\u0027s `Accept` header contains `html`, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or `deepObject` query parameter, which appear in the JSON Schema error\u0027s instance path when a schema rejects them (for example under `additionalProperties: false`), and the raw `Content-Type` header, reflected in unsupported-media-type errors when it fails to parse.\n\nBecause browsers send `Accept: text/html` on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom `Content-Type`, or attacker-controlled script on the victim\u0027s side is required. A payload such as `filter[\u003c/code\u003e\u003c/h2\u003e\u003cscript\u003ealert(document.domain)\u003c/script\u003e]=x` terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin\u0027s cookies, session, and same-origin responses.\n\nBoth HTML error rendering and the vulnerable handler are enabled by default: `Oaskit.Plugs.ValidateRequest` defaults `:html_errors` to `true` and `:error_handler` to `Oaskit.ErrorHandler.Default`, so applications following the documented usage are affected without any opt-in.\n\nThis issue affects oaskit: from 0.1.0 before 0.14.1."
}
],
"value": "Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler.\n\nOaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 in lib/oaskit/error_handler/default.ex render request-validation failures as an HTML page whenever the request\u0027s Accept header contains html, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or deepObject query parameter, which appear in the JSON Schema error\u0027s instance path when a schema rejects them (for example under additionalProperties: false), and the raw Content-Type header, reflected in unsupported-media-type errors when it fails to parse.\n\nBecause browsers send Accept: text/html on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom Content-Type, or attacker-controlled script on the victim\u0027s side is required. A payload such as filter[\u003c/code\u003e\u003c/h2\u003e\u003cscript\u003ealert(document.domain)\u003c/script\u003e]=x terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin\u0027s cookies, session, and same-origin responses.\n\nBoth HTML error rendering and the vulnerable handler are enabled by default: Oaskit.Plugs.ValidateRequest defaults :html_errors to true and :error_handler to Oaskit.ErrorHandler.Default, so applications following the documented usage are affected without any opt-in.\n\nThis issue affects oaskit: from 0.1.0 before 0.14.1."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:04:30.556Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-66296.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-66296"
},
{
"tags": [
"patch"
],
"url": "https://github.com/lud/oaskit/commit/b70c6b2eaf0b11bdd0bbb21b8a87dbb3d46918a1"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Reflected XSS in oaskit\u0027s default HTML error handler",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable HTML error rendering so that validation failures are returned as JSON only:\u003c/p\u003e\n\u003cpre\u003e\u003ccode class=\"language-elixir\"\u003eplug Oaskit.Plugs.ValidateRequest, html_errors: false\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThis prevents the vulnerable HTML page from being rendered at all, on any oaskit version. Alternatively, configure a custom \u003ccode\u003e:error_handler\u003c/code\u003e that does not emit HTML built from request-derived values.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Disable HTML error rendering so that validation failures are returned as JSON only:\n\n```elixir\nplug Oaskit.Plugs.ValidateRequest, html_errors: false\n```\n\nThis prevents the vulnerable HTML page from being rendered at all, on any oaskit version. Alternatively, configure a custom `:error_handler` that does not emit HTML built from request-derived values."
}
],
"value": "Disable HTML error rendering so that validation failures are returned as JSON only:\n\nplug Oaskit.Plugs.ValidateRequest, html_errors: false\n\nThis prevents the vulnerable HTML page from being rendered at all, on any oaskit version. Alternatively, configure a custom :error_handler that does not emit HTML built from request-derived values."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-66296",
"datePublished": "2026-08-03T19:04:30.556Z",
"dateReserved": "2026-07-24T14:10:01.114Z",
"dateUpdated": "2026-08-03T19:50:27.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-66296",
"date": "2026-10-25",
"epss": "0.00367",
"percentile": "0.30284"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:lud:oaskit:*:*:*:*:*:elixir:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Oaskit.ErrorHandler.Default"
],
"packageName": "oaskit",
"packageURL": "pkg:hex/oaskit",
"product": "oaskit",
"programFiles": [
"lib/oaskit/error_handler/default.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:format_reason/4"
},
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:reason_to_html/1"
}
],
"repo": "https://github.com/lud/oaskit",
"vendor": "lud",
"versions": [
{
"lessThan": "0.14.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:lud:oaskit:*:*:*:*:*:elixir:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Oaskit.ErrorHandler.Default"
],
"packageName": "lud/oaskit",
"packageURL": "pkg:github/lud/oaskit",
"product": "oaskit",
"programFiles": [
"lib/oaskit/error_handler/default.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:format_reason/4"
},
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:reason_to_html/1"
}
],
"repo": "https://github.com/lud/oaskit",
"vendor": "lud",
"versions": [
{
"lessThan": "b70c6b2eaf0b11bdd0bbb21b8a87dbb3d46918a1",
"status": "affected",
"version": "552de8ca0ff60617bea58bcafa451892d61a161c",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lud:oaskit:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6A883114-0624-4C87-8FAF-B8C277AB8B61",
"versionEndExcluding": "0.14.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler.\n\nOaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 in lib/oaskit/error_handler/default.ex render request-validation failures as an HTML page whenever the request\u0027s Accept header contains html, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or deepObject query parameter, which appear in the JSON Schema error\u0027s instance path when a schema rejects them (for example under additionalProperties: false), and the raw Content-Type header, reflected in unsupported-media-type errors when it fails to parse.\n\nBecause browsers send Accept: text/html on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom Content-Type, or attacker-controlled script on the victim\u0027s side is required. A payload such as filter[\u003c/code\u003e\u003c/h2\u003e\u003cscript\u003ealert(document.domain)\u003c/script\u003e]=x terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin\u0027s cookies, session, and same-origin responses.\n\nBoth HTML error rendering and the vulnerable handler are enabled by default: Oaskit.Plugs.ValidateRequest defaults :html_errors to true and :error_handler to Oaskit.ErrorHandler.Default, so applications following the documented usage are affected without any opt-in.\n\nThis issue affects oaskit: from 0.1.0 before 0.14.1."
},
{
"lang": "es",
"value": "Vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web (XSS) en lud oaskit permite cross-site scripting reflejado a trav\u00e9s del gestor de errores HTML predeterminado.\n\nOaskit.ErrorHandler.Default.format_reason/4 y Oaskit.ErrorHandler.Default.reason_to_html/1 en lib/oaskit/error_handler/default.ex renderizan fallos de validaci\u00f3n de solicitudes como una p\u00e1gina HTML siempre que el encabezado Accept de la solicitud contenga html, interpolando cadenas controladas por la solicitud en esa p\u00e1gina sin escape HTML. Los valores sin escape son claves de objeto tomadas de un cuerpo de solicitud o de un par\u00e1metro de consulta de tipo object o deepObject, que aparecen en la ruta de instancia del error de JSON Schema cuando un esquema los rechaza (por ejemplo, bajo additionalProperties: false), y el encabezado Content-Type sin procesar, reflejado en errores de tipo de medio no compatible (unsupported-media-type) cuando falla al analizarse.\n\nDebido a que los navegadores env\u00edan Accept: text/html en la navegaci\u00f3n de nivel superior ordinaria, un enlace GET manipulado es suficiente para activar la p\u00e1gina de error; no se requiere el env\u00edo de formularios, un Content-Type personalizado o un script controlado por el atacante en el lado de la v\u00edctima. Una carga \u00fatil como filter[[/code][/h2][script_tag]alert(document.domain)[/script]]=x termina el marcado envolvente y el script inyectado se ejecuta en el origen de la aplicaci\u00f3n que utiliza oaskit, d\u00e1ndole acceso a las cookies, la sesi\u00f3n y las respuestas del mismo origen de ese origen.\n\nTanto la renderizaci\u00f3n de errores HTML como el gestor vulnerable est\u00e1n habilitados por defecto: Oaskit.Plugs.ValidateRequest establece por defecto :html_errors en true y :error_handler en Oaskit.ErrorHandler.Default, por lo que las aplicaciones que siguen el uso documentado se ven afectadas sin necesidad de una activaci\u00f3n expl\u00edcita.\n\nEste problema afecta a oaskit: desde 0.1.0 antes de 0.14.1."
}
],
"id": "CVE-2026-66296",
"lastModified": "2026-10-23T21:10:00.157",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-66296",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:50:03.665445Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-03T20:17:25.720",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-66296.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
],
"url": "https://github.com/lud/oaskit/commit/b70c6b2eaf0b11bdd0bbb21b8a87dbb3d46918a1"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-66296"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66296",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:50:03.665445Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:50:23.782Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:lud:oaskit:*:*:*:*:*:elixir:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Oaskit.ErrorHandler.Default"
],
"packageName": "oaskit",
"packageURL": "pkg:hex/oaskit",
"product": "oaskit",
"programFiles": [
"lib/oaskit/error_handler/default.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:format_reason/4"
},
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:reason_to_html/1"
}
],
"repo": "https://github.com/lud/oaskit",
"vendor": "lud",
"versions": [
{
"lessThan": "0.14.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:lud:oaskit:*:*:*:*:*:elixir:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Oaskit.ErrorHandler.Default"
],
"packageName": "lud/oaskit",
"packageURL": "pkg:github/lud/oaskit",
"product": "oaskit",
"programFiles": [
"lib/oaskit/error_handler/default.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:format_reason/4"
},
{
"name": "\u0027Elixir.Oaskit.ErrorHandler.Default\u0027:reason_to_html/1"
}
],
"repo": "https://github.com/lud/oaskit",
"vendor": "lud",
"versions": [
{
"lessThan": "b70c6b2eaf0b11bdd0bbb21b8a87dbb3d46918a1",
"status": "affected",
"version": "552de8ca0ff60617bea58bcafa451892d61a161c",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lud:oaskit:*:*:*:*:*:elixir:*:*",
"versionEndExcluding": "0.14.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ludovic Dem"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ludovic Dem"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"datePublic": "2026-07-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eOaskit.ErrorHandler.Default.format_reason/4\u003c/code\u003e and \u003ccode\u003eOaskit.ErrorHandler.Default.reason_to_html/1\u003c/code\u003e in \u003ccode\u003elib/oaskit/error_handler/default.ex\u003c/code\u003e render request-validation failures as an HTML page whenever the request\u0027s \u003ccode\u003eAccept\u003c/code\u003e header contains \u003ccode\u003ehtml\u003c/code\u003e, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or \u003ccode\u003edeepObject\u003c/code\u003e query parameter, which appear in the JSON Schema error\u0027s instance path when a schema rejects them (for example under \u003ccode\u003eadditionalProperties: false\u003c/code\u003e), and the raw \u003ccode\u003eContent-Type\u003c/code\u003e header, reflected in unsupported-media-type errors when it fails to parse.\u003c/p\u003e\n\u003cp\u003eBecause browsers send \u003ccode\u003eAccept: text/html\u003c/code\u003e on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom \u003ccode\u003eContent-Type\u003c/code\u003e, or attacker-controlled script on the victim\u0027s side is required. A payload such as \u003ccode\u003efilter[\u0026lt;/code\u0026gt;\u0026lt;/h2\u0026gt;\u0026lt;script\u0026gt;alert(document.domain)\u0026lt;/script\u0026gt;]=x\u003c/code\u003e terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin\u0027s cookies, session, and same-origin responses.\u003c/p\u003e\n\u003cp\u003eBoth HTML error rendering and the vulnerable handler are enabled by default: \u003ccode\u003eOaskit.Plugs.ValidateRequest\u003c/code\u003e defaults \u003ccode\u003e:html_errors\u003c/code\u003e to \u003ccode\u003etrue\u003c/code\u003e and \u003ccode\u003e:error_handler\u003c/code\u003e to \u003ccode\u003eOaskit.ErrorHandler.Default\u003c/code\u003e, so applications following the documented usage are affected without any opt-in.\u003c/p\u003e\n\u003cp\u003eThis issue affects oaskit: from 0.1.0 before 0.14.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler.\n\n`Oaskit.ErrorHandler.Default.format_reason/4` and `Oaskit.ErrorHandler.Default.reason_to_html/1` in `lib/oaskit/error_handler/default.ex` render request-validation failures as an HTML page whenever the request\u0027s `Accept` header contains `html`, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or `deepObject` query parameter, which appear in the JSON Schema error\u0027s instance path when a schema rejects them (for example under `additionalProperties: false`), and the raw `Content-Type` header, reflected in unsupported-media-type errors when it fails to parse.\n\nBecause browsers send `Accept: text/html` on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom `Content-Type`, or attacker-controlled script on the victim\u0027s side is required. A payload such as `filter[\u003c/code\u003e\u003c/h2\u003e\u003cscript\u003ealert(document.domain)\u003c/script\u003e]=x` terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin\u0027s cookies, session, and same-origin responses.\n\nBoth HTML error rendering and the vulnerable handler are enabled by default: `Oaskit.Plugs.ValidateRequest` defaults `:html_errors` to `true` and `:error_handler` to `Oaskit.ErrorHandler.Default`, so applications following the documented usage are affected without any opt-in.\n\nThis issue affects oaskit: from 0.1.0 before 0.14.1."
}
],
"value": "Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler.\n\nOaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 in lib/oaskit/error_handler/default.ex render request-validation failures as an HTML page whenever the request\u0027s Accept header contains html, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or deepObject query parameter, which appear in the JSON Schema error\u0027s instance path when a schema rejects them (for example under additionalProperties: false), and the raw Content-Type header, reflected in unsupported-media-type errors when it fails to parse.\n\nBecause browsers send Accept: text/html on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom Content-Type, or attacker-controlled script on the victim\u0027s side is required. A payload such as filter[\u003c/code\u003e\u003c/h2\u003e\u003cscript\u003ealert(document.domain)\u003c/script\u003e]=x terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin\u0027s cookies, session, and same-origin responses.\n\nBoth HTML error rendering and the vulnerable handler are enabled by default: Oaskit.Plugs.ValidateRequest defaults :html_errors to true and :error_handler to Oaskit.ErrorHandler.Default, so applications following the documented usage are affected without any opt-in.\n\nThis issue affects oaskit: from 0.1.0 before 0.14.1."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:04:30.556Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-66296.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-66296"
},
{
"tags": [
"patch"
],
"url": "https://github.com/lud/oaskit/commit/b70c6b2eaf0b11bdd0bbb21b8a87dbb3d46918a1"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Reflected XSS in oaskit\u0027s default HTML error handler",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable HTML error rendering so that validation failures are returned as JSON only:\u003c/p\u003e\n\u003cpre\u003e\u003ccode class=\"language-elixir\"\u003eplug Oaskit.Plugs.ValidateRequest, html_errors: false\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThis prevents the vulnerable HTML page from being rendered at all, on any oaskit version. Alternatively, configure a custom \u003ccode\u003e:error_handler\u003c/code\u003e that does not emit HTML built from request-derived values.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Disable HTML error rendering so that validation failures are returned as JSON only:\n\n```elixir\nplug Oaskit.Plugs.ValidateRequest, html_errors: false\n```\n\nThis prevents the vulnerable HTML page from being rendered at all, on any oaskit version. Alternatively, configure a custom `:error_handler` that does not emit HTML built from request-derived values."
}
],
"value": "Disable HTML error rendering so that validation failures are returned as JSON only:\n\nplug Oaskit.Plugs.ValidateRequest, html_errors: false\n\nThis prevents the vulnerable HTML page from being rendered at all, on any oaskit version. Alternatively, configure a custom :error_handler that does not emit HTML built from request-derived values."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-66296",
"datePublished": "2026-08-03T19:04:30.556Z",
"dateReserved": "2026-07-24T14:10:01.114Z",
"dateUpdated": "2026-08-03T19:50:27.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.