CVE-2026-21618 Cross-site scripting (XSS) in OAuth Device Authorization screen

[
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.HexpmWeb.SharedAuthorizationView'"
    ],
    "packageName": "hexpm/hexpm",
    "packageURL": "pkg:github/hexpm/hexpm",
    "product": "hexpm",
    "programFiles": [
      "lib/hexpm_web/views/shared_authorization_view.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3"
      }
    ],
    "repo": "https://github.com/hexpm/hexpm.git",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "c692438684ead90c3bcbfb9ccf4e63c768c668a8",
        "status": "affected",
        "version": "617e44c71f1dd9043870205f371d375c5c4d886d",
        "versionType": "git"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "hex.pm",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "2026-01-19",
        "status": "affected",
        "version": "2025-10-01",
        "versionType": "date"
      }
    ]
  }
]