The absinthe-graphql absinthe_plug library contains a reflected XSS vulnerability in its GraphiQL interface due to improper escaping of backslashes in the query GET parameter. The js_escape/1 function escapes single quotes and newlines but omits backslash escaping, enabling an attacker to inject JavaScript by prefixing a quote with a backslash. This vulnerability affects versions from 1.2.0 before 1.5.10. The CVSS 4.0 score is 2.3 (low severity). No patch or official remediation level is documented, and the product is not a cloud service.

An attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of a victim's browser when they access the vulnerable GraphiQL interface with a crafted query parameter. This can lead to typical reflected XSS impacts such as session hijacking or UI manipulation. However, the low CVSS score and lack of known exploits suggest limited impact or difficulty in exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor the vendor's announcements for updates. Until a patch is available, consider restricting access to the GraphiQL interface or implementing web application firewall (WAF) rules to detect and block suspicious query parameters that may exploit this XSS vulnerability.