Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

gg.jte:jte

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1MavenPublished

    jte's HTML templates containing Javascript template strings are subject to XSS

    CVE-2025-23026 · GHSA-vh22-6c6h-rm8q

    Affected
    • Maven gg.jte:jte <= 3.1.15
    Fixed in
    3.1.16· Vendor fix available
    Issue
    Jte HTML templates with script tags or script attributes that include a Javascript template string (backticks) are subject to XSS. Details The javaScriptBlock and javaScriptAttribute methods in the Escape class (source) do not escape backticks, which are used for Javascript template strings. Dollar signs in template strings should also be escaped as well to prevent undesired interpolation. PoC 1. Use the Jte Gradle Plugin with the following code in src/jte/xss.jte: 2. Use the following Java code to demonstrate the XSS vulnerability: Impact HTML templates rendered by Jte's OwaspHtmlTemplateOutput in versions less than or equal to 3.1.15 with script tags or script attributes that contain Javascript template strings (backticks) are vulnerable.

    Recommended action: Upgrade to 3.1.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →