CVE-2026-66296: Reflected XSS in oaskit's default HTML error handler
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler.
Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex render request-validation failures as an HTML page whenever the request's Accept header contains html, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or deepObject query parameter, which appear in the JSON Schema error's instance path when a schema rejects them (for example under additionalProperties: false), and the raw Content-Type header, reflected in unsupported-media-type errors when it fails to parse.
Because browsers send Accept: text/html on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom Content-Type, or attacker-controlled script on the victim's side is required. A payload such as filter[</code></h2><script>alert(document.domain)</script>]=x terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin's cookies, session, and same-origin responses.
Both HTML error rendering and the vulnerable handler are enabled by default: Oaskit.Plugs.ValidateRequest defaults :htmlerrors to true and :errorhandler to Oaskit.ErrorHandler.Default, so applications following the documented usage are affected without any opt-in.
This issue affects oaskit: from 0.1.0 before 0.14.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
oaskitto a version that resolves this vulnerability.Fixed in 0.14.1 - Configuration
Disable the default HTML error rendering by setting :html_errors to false in Oaskit.Plugs.ValidateRequest, so request-validation failures are not rendered as HTML by the default error handler.
Oaskit.Plugs.ValidateRequest :html_errors = false - Configuration
Avoid the vulnerable HTML rendering path by overriding :error_handler in Oaskit.Plugs.ValidateRequest (do not use Oaskit.ErrorHandler.Default), since Oaskit.ErrorHandler.Default.format_reason/4 and reason_to_html/1 render request-controlled strings into an HTML page when the request Accept header contains html.
Oaskit.Plugs.ValidateRequest :error_handler = Oaskit.ErrorHandler.Default (override with a non-HTML handler)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66296?
CVE-2026-66296 has a risk score of 54, indicating a medium severity vulnerability.
How do I fix CVE-2026-66296?
To resolve CVE-2026-66296, ensure proper input validation and output encoding in the error handling routines of oaskit.
What kind of vulnerability is CVE-2026-66296?
CVE-2026-66296 is a reflected cross-site scripting (XSS) vulnerability affecting the default HTML error handler in oaskit.
What products are affected by CVE-2026-66296?
CVE-2026-66296 affects the oaskit software, specifically its default error handling functionality.
When was CVE-2026-66296 published?
CVE-2026-66296 was published on August 3, 2026.