CVE-2026-66882: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in team-alembic ash_authentication

The vulnerability arises because the ash_authentication library uses EEx templates with unescaped interpolation (<%= %>) for parameters in confirmation and magic link forms. Specifically, the confirm parameter and the magic link token parameter are embedded directly into hidden input values without HTML escaping. The accept handlers do not validate or verify these parameters before rendering, allowing an attacker to inject arbitrary HTML or JavaScript by crafting a malicious URL. Since the affected pages are served over GET requests and no authentication is required to trigger the vulnerability, an attacker can exploit this by enticing a user to visit a crafted link. The injected script executes in the origin of the application embedding ash_authentication, potentially compromising user session and cookie data. The affected versions are >=4.8.0 <4.14.2 and >=5.0.0-rc.0 <5.0.0-rc.13.

An attacker can perform reflected cross-site scripting attacks, executing arbitrary scripts in the context of the vulnerable application. This can lead to theft of cookies, session tokens, or other sensitive information accessible to the browser within the application's origin. Because the vulnerable pages are part of the authentication flow, users may be tricked into clicking malicious links that appear legitimate, increasing the risk of successful exploitation. However, the CVSS score and description indicate the overall severity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling require_interaction? with ash_authentication or do not expose the affected confirmation and magic link forms to untrusted input. Implement input validation and proper HTML escaping for parameters embedded in templates. Monitor vendor channels for updates and apply official patches once released.