This vulnerability arises from the default HTML error handler in the oaskit library. It improperly interpolates unescaped request‑derived strings into an HTML page that is returned when a validation error occurs. The attack may lead to the execution of arbitrary scripts in the victim’s browser, potentially allowing theft of session cookies or other sensitive data. The weakness is a classic reflected XSS (CWE‑79).

The affected product is the Elixir web framework component oaskit, particularly versions ranging from 0.1.0 up to and including 0.14.0. Both the HTML error rendering and the default error handler are enabled by default, so any application that follows the documented usage pattern without custom configuration is at risk.

The CVSS score of 5.1 indicates a medium severity, the EPSS score of < 1% indicates a low probability of exploitation, and the vulnerability does not appear in the CISA KEV catalog. Because browsers automatically send an Accept header of text/html during regular navigation, a simple crafted GET request is sufficient to trigger the reflected XSS; no special attacker‑controlled content type or form submission is needed. An attacker can freely embed malicious payloads within the query string or request body, causing the error page to be rendered and the script to execute in the context of the web application.