The vulnerability is a reflected cross‑site scripting flaw in the GraphiQL interface of absinthe_plug. A crafted query string containing backslashes can bypass the existing JavaScript escaping, allowing an attacker to inject arbitrary JavaScript code that executes in the victim's browser when the query is echoed in an inline script. This flaw falls under CWE‑79 and can compromise confidentiality, integrity, and availability of user sessions by stealing credentials, defacing web pages, or manipulating the application logic.

The affected product is absinthe_plug, which runs in Elixir/Absinthe GraphQL applications. Versions 1.2.0 through 1.5.9 are affected; 1.5.10 and later include the fix. The flaw is present in the js_escape/1 function in the GraphiQL module.

The CVSS score of 2.3 indicates low severity from a technical standpoint, but the impact is localized to browsers that render the reflected input. The EPSS score is < 1%, a KEV flag is not set, and the vulnerability is not cataloged as a known exploited vulnerability. The attack vector is a reflected XSS that requires an attacker to lure a victim to a URL containing the malicious query string that includes a backslash‑escaped quote. No prerequisite server compromise is needed, and exploitation is possible only in environments where GraphiQL is exposed to untrusted users.