XSS vulnerability in GraphiQL implementation

[bryanenders]

The value of the GET parameter query is returned unescaped in the main block of inline JavaScript. Without Content Security Policy (CSP), one is able to break out of the config variable and execute arbitrary JavaScript.

It appears that graphiql_workspace.html.eex renders the page with the query_string variable. This template is loaded by Absinthe.Plug.GraphiQL which attempts to escape the query parameter. It is trivial to bypass this escaping with a backslash.

Steps to Reproduce

1. Browse /api/v2_alpha/graphiql?query=xxx\%27});confirm(document.domain);%20var%20x=new%20graphiqlWorkspace.AppConfig(%22x%22,{//.
2. Observe the JavaScript alert dialog with the value of document.domain.

Credits

40826d uncovered this vulnerability and wrote the initial draft of this bug report

[maennchen]

@benwilson512 This deserves a CVE. Would you like to create an advisory in the repo or should I create one and just refer to this issue?

[tompesman]

Now there is a CVE, could you make a release with the fix? Thanks!

[binaryseed]

A release has been published:

• https://github.com/absinthe-graphql/absinthe_plug/releases/tag/v1.5.10

@maennchen Can you update the CVE https://cna.erlef.org/cves/CVE-2026-42794.html ?

[maennchen]

@binaryseed Done. It will take around an hour to propagate to hex.pm.