Improper Neutralization of Input During Web Page Generation (XSS or 'Cross‑site Scripting') vulnerability in hexpm hexpm/hexpm's 'Elixir.HexpmWeb.SharedAuthorizationView' modules permits injection of unsanitized data into the OAuth Device Authorization screen via the program files lib/hexpm_web/views/shared_authorization_view.ex and the routine 'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3. When a user views the affected screen, malicious content can execute client‑side scripts in the victim’s browser, potentially leading to arbitrary JavaScript execution and enabling the theft of session cookies, tokens, or other client‑side attacks.

Hex.pm packages and the hex.pm application are impacted. Specifically, versions before the commit c692438684ead90c3bcbfb9ccf4e63c768c668a8 for hexpm:hex.pm and before 2026-01-19 for hex.pm. The affected modules and routines are lib/hexpm_web/views/shared_authorization_view.ex and the function render_grouped_scopes/3 in Elixir.HexpmWeb.SharedAuthorizationView.

CVSS base score of 8.5 indicates high severity. EPSS less than 1% suggests very low likelihood of widespread exploitation. There is no entry in KEV. Based on the description, the attack vector appears to be through the OAuth Device Authorization screen, requiring a crafted URL or redirect context that invites a user to authenticate with the maliciously crafted device. Being a client‑side flaw, it does not require elevated privileges. Because the flaw allows arbitrary JavaScript in the OAuth redirect context, an attacker could hijack an existing user session or inject malicious content.