Read the docs
TI-2026-17410 Aliases CVE-2026-21618

Cross-site scripting (XSS) in OAuth Device Authorization screen

Priority MEDIUM 44CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/hexpm_web/views/shared_authorization_view.ex and program routines 'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3. This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3bcbfb9ccf4e63c768c668a8; hex.pm: from 2025-10-01 before 2026-01-19.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00261 17th percentileScored 2026-11-07
Fix Fixed hex.pm (hexpm): 2026-01-19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hexpmhex.pm2025-10-01 to before 2026-01-192026-01-19Patch availableCNA
  • hex.pm Vendorhexpm Affected 2025-10-01 to before 2026-01-19 Fixed in 2026-01-19 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hex:hexpm:*:*:*:*:*:*:*:*2025-10-01 to before 2026-01-19Vulnerablehexpm
  • cpe:2.3:a:hex:hexpm:*:*:*:*:*:*:*:* Versions 2025-10-01 to before 2026-01-19 Vulnerable ·hexpm

Remediation

  • Fix · CNA hex.pm (hexpm) Fixed in 2026-01-19

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21618

References

Patch 1

Advisory 1

Other 2

  • TI-2026-17414 Password Reset Tokens Do Not Expire CVSS 4.0CRITICAL 9.5
  • TI-2026-19283 Denial of Service via Oversized Package Upload CVSS 4.0HIGH 7.1
  • TI-2026-19282 Path Traversal in Local File Store Backend CVSS 4.0MEDIUM 6.9
  • TI-2026-17413 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences