~ / search / GHSA-c62g-j346-39v5

GHSA-c62g-j346-39v5

absinthe_plug Has a Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2026-42794

Packages

EcosystemPackageAffectedFixed in
Hex absinthe_plug >= 1.2.0, <= 1.5.9 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows reflected cross-site scripting via the GraphiQL interface. 'Elixir.Absinthe.Plug.GraphiQL':js_escape/1 in lib/absinthe/plug/graphiql.ex escapes single quotes and newlines in the query GET parameter before embedding it in an inline JavaScript string, but does not escape backslashes. An attacker can bypass the escaping by prefixing a quote with a backslash (e.g. \'), breaking out of the string context and executing arbitrary JavaScript in the victim's browser. This issue affects absinthe_plug: from 1.2.0.

References

External links from the advisory. They lead to third-party sites.