Improper Neutralization of Input During Web Page Generation (XSS) in hexpm/hexpm’s SharedAuthorizationView, specifically render_grouped_scopes/3, allows an attacker to inject malicious script. This could run in the victim’s browser, potentially stealing session cookies, tokens, or executing malicious actions in the attacker’s context. The weakness is identified as CWE-79.

Hex.pm packages and the hex.pm application are impacted. Specifically versions before the commit c692438684ead90c3bcbfb9ccf4e63c768c668a8 or before 2026-01-19 for hex.pm. The affected modules are lib/hexpm_web/views/shared_authorization_view.ex.

CVSS base score of 8.5 indicates high severity. EPSS less than 1% suggests very low likelihood of widespread exploitation. There is no entry in KEV. Attack vector is cross-domain inherited via the OAuth Device Authorization screen; the vulnerability requires a crafted URL or redirect context that invites a user to authenticate with the maliciously crafted device. The flaw is client-side; no additional privileges are required. Because the flaw allows arbitrary JavaScript in the OAuth redirect context, an attacker could hijack an existing user session or inject malicious content.