Reflected Cross-Site Scripting Vulnerability in Oaskit by Lud

CVE-2026-66296

What is CVE-2026-66296?

An improper neutralization of input during web page generation in Oaskit allows attackers to exploit reflected cross-site scripting (XSS) vulnerabilities via the default HTML error handler. When the Accept header indicates HTML, the Oaskit.ErrorHandler.Default renders error messages containing user-controlled input without proper HTML escaping. This leads to the possibility of injecting malicious scripts into the HTML response, which is then executed in the browser context of the affected application. The vulnerability affects all applications using Oaskit with default settings since HTML error handling is enabled by default. Affected versions include Oaskit from 0.1.0 to 0.14.0.

References