CVE-2026-66296

oaskit versions 0.1.0 through before 0.14.1 contain a reflected cross-site scripting flaw in Oaskit.ErrorHandler.Default (format_reason/4 and reason_to_html/1), which renders request-validation failures as an HTML page whenever the request's Accept header includes html and interpolates request-controlled strings without HTML escaping. The unescaped values are object keys from the request body or from object/deepObject query parameters (reflected in the JSON Schema error's instance path, e.g. when a schema uses additionalProperties: false) and the raw Content-Type header (reflected in unsupported-media-type errors); because browsers send Accept: text/html on ordinary navigation, a single crafted GET link such as one carrying a key like filter[ ]=x is sufficient to inject and execute script, with no form POST or attacker-hosted script required. The injected script runs in the origin of the application using oaskit, giving the attacker access to that origin's cookies, session, and same-origin responses as the victim. Any Elixir/Phoenix application using an affected oaskit version is exposed by default, since Oaskit.Plugs.ValidateRequest defaults :html_errors to true and :error_handler to the vulnerable default handler, so no opt-in is needed. No exploitation in the wild is known at this time; the flaw has a CVSS 4.0 score of 5.1 (medium), EPSS of 0.2% over 30 days, is not in CISA KEV, and a public advisory/PoC exists (GHSA-h7xw-x8wr-xpcc).

What to do: Upgrade oaskit to 0.14.1 or later. Applications that cannot upgrade immediately should set :html_errors to false (or supply a custom error handler that HTML-escapes reflected values) on Oaskit.Plugs.ValidateRequest, since the vulnerable default handler is enabled by default. Audit whether your application renders validation errors to browser navigations (e.g., GET endpoints with object/deepObject query parameters rejected under additionalProperties: false) and whether links to them could be attacker-crafted.