CVE-2026-66296

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 in lib/oaskit/error_handler/default.ex render request-validation failures as an HTML page whenever the request's Accept header contains html, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or deepObject query parameter, which appear in the JSON Schema error's instance path when a schema rejects them (for example under additionalProperties: false), and the raw Content-Type header, reflected in unsupported-media-type errors when it fails to parse. Because browsers send Accept: text/html on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom Content-Type, or attacker-controlled script on the victim's side is required. A payload such as filter[</code></h2><script>alert(document.domain)</script>]=x terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin's cookies, session, and same-origin responses. Both HTML error rendering and the vulnerable handler are enabled by default: Oaskit.Plugs.ValidateRequest defaults :html_errors to true and :error_handler to Oaskit.ErrorHandler.Default, so applications following the documented usage are affected without any opt-in. This issue affects oaskit: from 0.1.0 before 0.14.1.

• CWE-79

• https://cna.erlef.org/cves/CVE-2026-66296.html
• https://github.com/lud/oaskit/commit/b70c6b2eaf0b11bdd0bbb21b8a87dbb3d46918a1
• https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc
• https://osv.dev/vulnerability/EEF-CVE-2026-66296
• https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc

Published

Aug 3, 2026

Last Modified

Aug 4, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66274A pre-authentication attacker could leverage type nesting to…7.5
• CVE-2026-66275An authenticated attacker could exceed the session flow cont…6.5
• CVE-2026-66276An authenticated attacker can craft a disposition frame with…6.5
• CVE-2026-66277It was not possible to govern the maximum number of transfer…6.5
• CVE-2026-6628A flaw has been found in phili67 Ecclesia CRM up to 8.0.0. T…6.3
• CVE-2026-6629A vulnerability has been found in Metasoft 美特软件 MetaCRM up t…7.3
• CVE-2026-66297Improper Neutralization of Special Elements used in an OS Co…4.9
• CVE-2026-66298Origin Validation Error vulnerability in livebook-dev livebo…8.6
• CVE-2026-66299Uncontrolled Resource Consumption vulnerability in Apache To…7.5
• CVE-2026-6630A vulnerability was found in Tenda F451 1.0.0.7_cn_svn7958. …8.8
• CVE-2026-66300SNOMED International Snowstorm contains a reflected XSS vuln…5
• CVE-2026-6631A vulnerability was determined in Tenda F451 1.0.0.7_cn_svn7…8.8