The vulnerability in lud oaskit (before version 0.14.1) involves improper neutralization of input during web page generation, specifically in the default HTML error handler functions Oaskit.ErrorHandler.Default.format_reason/4 and reason_to_html/1. These functions render request-validation failures as HTML pages and interpolate unescaped request-controlled strings such as object keys from request bodies or query parameters, and raw Content-Type headers, into the error page. Because browsers send Accept: text/html by default, an attacker can craft a GET request with malicious input that terminates the HTML markup and injects arbitrary script code. This reflected XSS can execute in the origin of the vulnerable application, potentially exposing cookies, sessions, and same-origin data. The default configuration enables this vulnerable error rendering, making applications using oaskit without modification susceptible.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the vulnerable application's origin. This can lead to theft of cookies, session tokens, and access to same-origin responses, potentially compromising user accounts and sensitive data. The vulnerability requires user interaction via a crafted link but no special privileges or complex conditions. The CVSS score is 6.1 (medium severity) reflecting network attack vector, low complexity, no privileges required, user interaction needed, and partial confidentiality and integrity impact.

No official patch or fix version is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the default HTML error rendering by configuring Oaskit.Plugs.ValidateRequest to set :html_errors to false or replacing the default error handler with a safe alternative that properly escapes user input. Avoid exposing detailed validation errors in HTML responses to untrusted users. Monitor vendor channels for updates and apply official patches once released.