CVE-2026-21618 Cross-site scripting (XSS) in OAuth Device Authorization screen

High 8.5 Published 19 Jan 2026 Updated 24 Jul 2026

An attacker can inject malicious scripts into the OAuth Device Authorization screen, potentially compromising user sessions or executing code in the victim's browser.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-21618?

CVE-2026-21618 is a high-severity cross-site scripting vulnerability in hexpm hex.pm, published on 19 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/hexpm_web/views/shared_authorization_view.ex and program routines 'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3.

This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3bcbfb9ccf4e63c768c668a8; hex.pm: from 2025-10-01 before 2026-01-19.

Weakness: CWE-79

Which versions are affected by CVE-2026-21618?

It affects 1 product.

Products include Hex Hexpm.

How do I fix CVE-2026-21618?

No fix has been published for CVE-2026-21618 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-21618 being exploited?

There is no known exploitation of CVE-2026-21618 in the wild and no public exploit code.

Sources

Also known as EEF-CVE-2026-21618, GHSA-6cw9-5gg4-rhpj.