CVE-2026-42794

Description

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows reflected cross-site scripting via the GraphiQL interface. 'Elixir.Absinthe.Plug.GraphiQL':js_escape/1 in lib/absinthe/plug/graphiql.ex escapes single quotes and newlines in the query GET parameter before embedding it in an inline JavaScript string, but does not escape backslashes. An attacker can bypass the escaping by prefixing a quote with a backslash (e.g. \'), breaking out of the string context and executing arbitrary JavaScript in the victim's browser. This issue affects absinthe_plug: from 1.2.0.

PUBLISHED Reserved 2026-04-29 | Published 2026-05-08 | Updated 2026-05-08 | Assigner EEF

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Credits

40826d finder

Bryan A. Enders finder

Leandro Moreno remediation developer

Ben Wilson remediation reviewer

References

github.com/absinthe-graphql/absinthe_plug/issues/275 exploit

github.com/absinthe-graphql/absinthe_plug/issues/275 vendor-advisory

cna.erlef.org/cves/CVE-2026-42794.html related

osv.dev/vulnerability/EEF-CVE-2026-42794 related

github.com/...ommit/23a0d5658d32420086711adf4ce8f05febb09963 patch

cve.org (CVE-2026-42794)

nvd.nist.gov (CVE-2026-42794)

Download JSON