hex absinthe_plug vulnerabilities

Latest hex absinthe_plug CVEs

Newest publication first

1. CVE-2026-42794 Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug

   Published 2026-05-08

   Low·CVSS 2.3 EPSS 0.28%

   Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows reflected cross-site scripting via the GraphiQL interface. 'Elixir.Absinthe.Plug.GraphiQL':js_escape/1 in lib/absinthe/plug/graphiql.ex escapes single quotes a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.