Oaskit
Monthly
Reflected XSS in oaskit (Elixir/Plug OpenAPI request-validation library) versions 0.1.0 through 0.14.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by inducing them to navigate to a crafted GET URL. The default HTML error handler interpolates request-controlled strings - object keys from query parameters or request bodies that appear in JSON Schema instance paths, and the raw Content-Type header - directly into HTML error pages without escaping. Both HTML error rendering and the vulnerable handler are enabled by default, so all applications following documented oaskit usage are exposed without any opt-in configuration; no public exploit tool is identified at time of analysis, though the advisory contains a working payload example demonstrating trivial exploitability.
Reflected XSS in oaskit (Elixir/Plug OpenAPI request-validation library) versions 0.1.0 through 0.14.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by inducing them to navigate to a crafted GET URL. The default HTML error handler interpolates request-controlled strings - object keys from query parameters or request bodies that appear in JSON Schema instance paths, and the raw Content-Type header - directly into HTML error pages without escaping. Both HTML error rendering and the vulnerable handler are enabled by default, so all applications following documented oaskit usage are exposed without any opt-in configuration; no public exploit tool is identified at time of analysis, though the advisory contains a working payload example demonstrating trivial exploitability.