CVE-2026-66296Reflected XSS in oaskit's default HTML error handler

5.1MediumCVSS base score
0.37%Exploitation in 30 daysEPSS · top 69% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
YesPublic exploitsa reference or SSVC says so

Description

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 in lib/oaskit/error_handler/default.ex render request-validation failures as an HTML page whenever the request's Accept header contains html, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or deepObject query parameter, which appear in the JSON Schema error's instance path when a schema rejects them (for example under additionalProperties: false), and the raw Content-Type header, reflected in unsupported-media-type errors when it fails to parse. Because browsers send Accept: text/html on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom Content-Type, or attacker-controlled script on the victim's side is required. A payload such as filter[</code></h2><script>alert(document.domain)</script>]=x terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin's cookies, session, and same-origin responses. Both HTML error rendering and the vulnerable handler are enabled by default: Oaskit.Plugs.ValidateRequest defaults :html_errors to true and :error_handler to Oaskit.ErrorHandler.Default, so applications following the documented usage are affected without any opt-in. This issue affects oaskit: from 0.1.0 before 0.14.1.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.

Show the exploits1

References tagged exploit1 reference

https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc (opens in a new tab)vendor-advisoryrelatedexploit

Timeline

2026
24 Jul 2026
24 Jul 2026
ID reserved
By EEF
3 Aug 202610 days later
3 Aug 2026· 10 days later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-66296, by who scored it
Scored by	CVSS	Score	Vector
EEFCNA (assigner)	4.0	Medium5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
NVDNVD · Analyzed	4.0	Medium5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.37% · top 69% of all CVEs (14 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Affected products

lud · oaskit
- affected 0.1.0 – < 0.14.1
lud · oaskit
- affected 552de8ca0ff60617bea58bcafa451892d61a161c – < b70c6b2eaf0b11bdd0bbb21b8a87dbb3d46918a1

What to do

Workaround: Disable HTML error rendering so that validation failures are returned as JSON only: plug Oaskit.Plugs.ValidateRequest, html_errors: false This prevents the vulnerable HTML page from being rendered at all, on any oaskit version. Alternatively, configure a custom :error_handler that does not emit HTML built from request-derived values.

References4

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-66296](https://cveledger.app/badge/CVE-2026-66296.svg)](https://cveledger.app/cve/CVE-2026-66296)

Record last updated 3 Aug 2026, 19:50 UTC.