CVE-2026-42794

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows reflected cross-site scripting via the GraphiQL interface. 'Elixir.Absinthe.Plug.GraphiQL':js_escape/1 in lib/absinthe/plug/graphiql.ex escapes single quotes and newlines in the query GET parameter before embedding it in an inline JavaScript string, but does not escape backslashes. An attacker can bypass the escaping by prefixing a quote with a backslash (e.g. \'), breaking out of the string context and executing arbitrary JavaScript in the victim's browser. This issue affects absinthe_plug: from 1.2.0 before 1.5.10.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://cna.erlef.org/cves/CVE-2026-42794.html	Third Party Advisory
https://github.com/absinthe-graphql/absinthe_plug/commit/23a0d5658d32420086711adf4ce8f05febb09963	Patch
https://github.com/absinthe-graphql/absinthe_plug/issues/275	Issue Tracking
https://osv.dev/vulnerability/EEF-CVE-2026-42794	Third Party Advisory
https://github.com/absinthe-graphql/absinthe_plug/issues/275	Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:absinthe-graphql:absinthe.plug:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-08 16:16

Updated : 2026-06-17 10:48

NVD link : CVE-2026-42794

Mitre link : CVE-2026-42794

CVE.ORG link : CVE-2026-42794

JSON object : View

Products Affected

absinthe-graphql

absinthe.plug

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-42794", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42794", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T16:07:51.313563Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:absinthe-graphql:absinthe_plug:*:*:*:*:*:*:*:*"], "repo": "https://github.com/absinthe-graphql/absinthe_plug", "vendor": "absinthe-graphql", "modules": ["'Elixir.Absinthe.Plug.GraphiQL'"], "product": "absinthe_plug", "versions": [{"status": "affected", "version": "1.2.0", "lessThan": "1.5.10", "versionType": "semver"}], "packageURL": "pkg:hex/absinthe_plug", "packageName": "absinthe_plug", "programFiles": ["lib/absinthe/plug/graphiql.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Absinthe.Plug.GraphiQL':js_escape/1"}]}, {"cpes": ["cpe:2.3:a:absinthe-graphql:absinthe_plug:*:*:*:*:*:*:*:*"], "repo": "https://github.com/absinthe-graphql/absinthe_plug", "vendor": "absinthe-graphql", "modules": ["'Elixir.Absinthe.Plug.GraphiQL'"], "product": "absinthe_plug", "versions": [{"status": "affected", "version": "26241817cb4b9be4de3f5972c5fba3d36de3d713", "lessThan": "23a0d5658d32420086711adf4ce8f05febb09963", "versionType": "git"}], "packageURL": "pkg:github/absinthe-graphql/absinthe_plug", "packageName": "absinthe-graphql/absinthe_plug", "programFiles": ["lib/absinthe/plug/graphiql.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Absinthe.Plug.GraphiQL':js_escape/1"}]}]}], "published": "2026-05-08T16:16:12.750", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-42794.html", "tags": ["Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/absinthe-graphql/absinthe_plug/commit/23a0d5658d32420086711adf4ce8f05febb09963", "tags": ["Patch"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/absinthe-graphql/absinthe_plug/issues/275", "tags": ["Issue Tracking"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-42794", "tags": ["Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/absinthe-graphql/absinthe_plug/issues/275", "tags": ["Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows reflected cross-site scripting via the GraphiQL interface.\n\n'Elixir.Absinthe.Plug.GraphiQL':js_escape/1 in lib/absinthe/plug/graphiql.ex escapes single quotes and newlines in the query GET parameter before embedding it in an inline JavaScript string, but does not escape backslashes. An attacker can bypass the escaping by prefixing a quote with a backslash (e.g. \\'), breaking out of the string context and executing arbitrary JavaScript in the victim's browser.\n\nThis issue affects absinthe_plug: from 1.2.0 before 1.5.10."}], "lastModified": "2026-06-17T10:48:25.320", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:absinthe-graphql:absinthe.plug:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EF9F187-A4F5-4D86-A3BF-7774F698CFED", "versionEndExcluding": "1.5.10", "versionStartIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}