Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-74 CWE-74 at MITRE

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): 5 CVEs (62.5%) — click to drill down Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): 2 CVEs (25.0%) — click to drill down Improper Control of Generation of Code ('Code Injection'): 1 CVEs (12.5%) — click to drill down Improper Neutralization of Special Elements used in a Command ('Command Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'): 0 CVEs (0.0%) — click to drill down XML Injection (aka Blind XPath Injection): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Formula Elements in a CSV File: 0 CVEs (0.0%) — click to drill down Total 8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 5 (62.5%) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-89 2 (25.0%) Improper Control of Generation of Code ('Code Injection') CWE-94 1 (12.5%) Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-77 0 (0.0%) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78 0 (0.0%) Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') CWE-88 0 (0.0%) XML Injection (aka Blind XPath Injection) CWE-91 0 (0.0%) Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') CWE-917 0 (0.0%) Improper Neutralization of Formula Elements in a CSV File CWE-1236 0 (0.0%)

CVEs

CVEs for Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-74

Summary Publication CVE ID Published
Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
pkg:hex/phoenix_live_view
pkg:github/phoenixframework/phoenix_live_view
CVE-2026-58228 2026-07-13
SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service
pkg:hex/postgrex
pkg:github/elixir-ecto/postgrex
CVE-2026-58225 2026-07-10
Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
pkg:hex/mdex
pkg:github/leandrocp/mdex
CVE-2026-54889 2026-06-29
Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
pkg:hex/mdex
pkg:github/leandrocp/mdex
pkg:hex/mdex_native
pkg:github/leandrocp/mdex_native
CVE-2026-53427 2026-06-29
Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
pkg:hex/phoenix_storybook
pkg:github/phenixdigital/phoenix_storybook
CVE-2026-8467 2026-05-20
SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3
pkg:hex/postgrex
pkg:github/elixir-ecto/postgrex
CVE-2026-32687 2026-05-12
Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug
pkg:hex/absinthe_plug
pkg:github/absinthe-graphql/absinthe_plug
CVE-2026-42794 2026-05-08
Cross-site scripting (XSS) in OAuth Device Authorization screen
pkg:github/hexpm/hexpm
CVE-2026-21618 2026-01-19
8 CVEs