VulnerabilityAnalyzed

CVE-2026-42794

LOW 2.3EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows reflected cross-site scripting via the GraphiQL interface. 'Elixir.Absinthe.Plug.GraphiQL':js_escape/1 in lib/absinthe/plug/graphiql.ex escapes single quotes and newlines in the query GET parameter before embedding it in an inline JavaScript string, but does not escape backslashes. An attacker can bypass the escaping by prefixing a quote with a backslash (e.g. \'), breaking out of the string context and executing arbitrary JavaScript in the victim's browser. This issue affects absinthe_plug: from 1.2.0 before 1.5.10.

CVSS 4.0: 2.3 LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.28% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: absinthe-graphql/absinthe.plug
Source: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db

References

https://cna.erlef.org/cves/CVE-2026-42794.htmlThird Party Advisory
https://github.com/absinthe-graphql/absinthe_plug/commit/23a0d5658d32420086711adf4ce8f05febb09963Patch
https://github.com/absinthe-graphql/absinthe_plug/issues/275Issue Tracking
https://osv.dev/vulnerability/EEF-CVE-2026-42794Third Party Advisory
https://github.com/absinthe-graphql/absinthe_plug/issues/275Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.