Executive brief
Oaskit is an Elixir library for validating API requests against OpenAPI schemas. A reflected cross-site scripting vulnerability in its default error handler allows an attacker to inject malicious JavaScript code into error pages by crafting a malicious URL. An attacker can exploit this to steal user sessions, cookies, and sensitive data from users who click on the link.
Technical details
This is a reflected XSS vulnerability in Oaskit.ErrorHandler.Default.format_reason/4 and reason_to_html/1, which render request-validation failures as HTML pages. The vulnerability exists because request-controlled strings—specifically object keys from request bodies and query parameters, plus raw Content-Type headers—are interpolated into the HTML response without proper escaping. The attack vector is a crafted GET link; since browsers send Accept: text/html on standard navigation, no user interaction beyond clicking a link is required. An attacker can terminate enclosing markup and inject JavaScript (e.g., filter[</code></h2><script>alert(document.domain)</script>]=x) that executes in the application's origin, providing access to cookies and session data. Both HTML error rendering and the vulnerable handler are enabled by default in Oaskit.Plugs.ValidateRequest, affecting all applications using documented configuration without explicit hardening.
Affected products
- lud oaskit from 0.1.0 before 0.14.1
Timeline
- 2026-08-03: disclosed