CVE-2026-66296

Name of the Vulnerable Software and Affected Versions oaskit versions 0.1.0 through 0.14.0

Description A reflected cross-site scripting (XSS) issue exists in the default HTML error handler. The functions format reason/4 and reason to html/1 in lib/oaskit/error handler/default.ex render request-validation failures as HTML pages when the Accept header contains html. This process interpolates request-controlled strings without proper HTML escaping. The affected values include object keys from the request body or object and deepObject query parameters, as well as the raw Content-Type header. An attacker can trigger this by using a crafted GET link, allowing the execution of arbitrary scripts in the application's origin, which provides access to cookies, sessions, and same-origin responses. This behavior is enabled by default via Oaskit.Plugs.ValidateRequest settings :html errors and :error handler.

Recommendations Update oaskit to version 0.14.1 or later. As a temporary workaround, disable HTML error rendering by setting html errors: false in Oaskit.Plugs.ValidateRequest to ensure validation failures are returned as JSON only. Alternatively, configure a custom :error handler that does not generate HTML from request-derived values.