Ludovic Dem

**Name of the Vulnerable Software and Affected Versions** oaskit versions 0.1.0 through 0.14.0 **Description** A reflected cross-site scripting (XSS) issue exists in the default HTML error handler. The functions `format reason/4` and `reason to html/1` in `lib/oaskit/error handler/default.ex` render request-validation failures as HTML pages when the `Accept` header contains `html`. This process interpolates request-controlled strings without proper HTML escaping. The affected values include object keys from the request body or `object` and `deepObject` query parameters, as well as the raw `Content-Type` header. An attacker can trigger this by using a crafted GET link, allowing the execution of arbitrary scripts in the application's origin, which provides access to cookies, sessions, and same-origin responses. This behavior is enabled by default via `Oaskit.Plugs.ValidateRequest` settings `:html errors` and `:error handler`. **Recommendations** Update oaskit to version 0.14.1 or later. As a temporary workaround, disable HTML error rendering by setting `html errors: false` in `Oaskit.Plugs.ValidateRequest` to ensure validation failures are returned as JSON only. Alternatively, configure a custom `:error handler` that does not generate HTML from request-derived values.