CVE-2026-42794

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42794
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42794.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42794
Aliases
Published
2026-05-08T15:42:40.706Z
Modified
2026-07-08T08:11:24.697106932Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug
Details

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows reflected cross-site scripting via the GraphiQL interface.

'Elixir.Absinthe.Plug.GraphiQL':js_escape/1 in lib/absinthe/plug/graphiql.ex escapes single quotes and newlines in the query GET parameter before embedding it in an inline JavaScript string, but does not escape backslashes. An attacker can bypass the escaping by prefixing a quote with a backslash (e.g. \'), breaking out of the string context and executing arbitrary JavaScript in the victim's browser.

This issue affects absinthe_plug: from 1.2.0 before 1.5.10.

Database specific 
{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-79"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "26241817cb4b9be4de3f5972c5fba3d36de3d713"
                },
                {
                    "fixed": "23a0d5658d32420086711adf4ce8f05febb09963"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42794.json"
}
References

Affected packages

Git / github.com/absinthe-graphql/absinthe_plug

Affected ranges

Type
GIT
Repo
https://github.com/absinthe-graphql/absinthe_plug
Events
Introduced
f99a6bfec177616c7ff9aad0c8adf03705a13bdd
Fixed
a20146ead4bdd885f3c22115fbe37b86b4330217
Fixed
23a0d5658d32420086711adf4ce8f05febb09963
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.2.0"
        },
        {
            "fixed": "1.5.10"
        }
    ],
    "cpe": "cpe:2.3:a:absinthe-graphql:absinthe.plug:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.4.0-beta.1
1.5.0-alpha.0
v1.*
v1.2.0
v1.2.2
v1.2.4
v1.3.0
v1.3.1
v1.4.0
v1.4.0-beta.1
v1.4.0-beta.2
v1.4.0-rc.2
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.6
v1.4.7
v1.5.0
v1.5.0-alpha.0
v1.5.0-rc.0
v1.5.0-rc.1
v1.5.0-rc.2
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.8
v1.5.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42794.json"