PT-2026-39147 · Unknown · Absinthe Plug

40826D + 2 · Published 2026-05-08 · Updated 2026-05-16 · CVE-2026-42794

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions absinthe plug versions 1.2.0 through 1.10.1

Description Reflected cross-site scripting is possible via the GraphiQL interface. The js escape/1 function in lib/absinthe/plug/graphiql.ex fails to escape backslashes when processing the query GET parameter before embedding it in an inline JavaScript string. An attacker can bypass existing escaping for single quotes and newlines by prefixing a quote with a backslash, allowing the execution of arbitrary JavaScript in the victim's browser.

Recommendations Update to version 1.10.2.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42794

GHSA-C62G-J346-39V5

Affected Products

Absinthe Plug

References · 12

• 🔥 https://github.com/absinthe-graphql/absinthe_plug/issues/275 · Exploit
• https://github.com/absinthe-graphql/absinthe_plug/commit/23a0d5658d32420086711adf4ce8f05febb09963 · Patch
• https://osv.dev/vulnerability/GHSA-c62g-j346-39v5 · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-42794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42794 · Security Note
• https://github.com/absinthe-graphql/absinthe_plug · Note
• https://t.me/cveNotify/163329 · Telegram Post
• https://t.me/cveNotify/163742 · Telegram Post
• https://hex.pm/packages/absinthe_plug · Note
• https://cna.erlef.org/cves/CVE-2026-42794.html · Note
• https://twitter.com/CVEnew/status/2052810969626157423 · Twitter Post
• https://t.me/CVEtracker/53135 · Telegram Post