CVE-2026-66296 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-66296MEDIUM

lud oaskit — Reflected XSS in oaskit's default HTML error handler

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   A   N   N   N    5.1   .0021   11.2     —

AFFECTED
  Product  Versions                                    Fixed
  oaskit   0.1.0 –                                     —
  oaskit   552de8ca0ff60617bea58bcafa451892d61a161c –  —

TIMELINE
  Jul 24  Reserved by EEF
  Aug 3   EXPLOIT PUBLISHED — CVE-2026-66296 (lud oaskit). Public exploit reference added.
  Aug 3   Published (CNA: EEF)

CWE-79 · CNA: EEF · CVSS v4.0 · 4 references · NVD status: Analyzed

Description

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 in lib/oaskit/error_handler/default.ex render request-validation failures as an HTML page whenever the request's Accept header contains html, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or deepObject query parameter, which appear in the JSON Schema error's instance path when a schema rejects them (for example under additionalProperties: false), and the raw Content-Type header, reflected in unsupported-media-type errors when it fails to parse. Because browsers send Accept: text/html on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom Content-Type, or attacker-controlled script on the victim's side is required. A payload such as filter[</code></h2><script>alert(document.domain)</script>]=x terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin's cookies, session, and same-origin responses. Both HTML error rendering and the vulnerable handler are enabled by default: Oaskit.Plugs.ValidateRequest defaults :html_errors to true and :error_handler to Oaskit.ErrorHandler.Default, so applications following the documented usage are affected without any opt-in. This issue affects oaskit: from 0.1.0 before 0.14.1.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 24, 2026	Reserved	Reserved by EEF
August 3, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-66296 (lud oaskit). Public exploit reference added.
August 3, 2026	Published	Published (CNA: EEF)

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
lud	oaskit	—	0.1.0	—
lud	oaskit	—	552de8ca0ff60617bea58bcafa451892d61a161c	—

Weaknesses

CWE-79

References (4)

https://cna.erlef.org/cves/CVE-2026-66296.html [Patch, Third Party Advisory]
https://github.com/lud/oaskit/commit/b70c6b2eaf0b11bdd0bbb21b8a87dbb3d46918a1 [Patch]
https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc [Exploit, Vendor Advisory]
https://osv.dev/vulnerability/EEF-CVE-2026-66296 [Patch, Third Party Advisory]

Authoritative record: CVE-2026-66296 at cve.org

Vendors: lud

Weaknesses: CWE-79

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-66296 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.