Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact There is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the preserveComments directive must be enabled in your policy file. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patches Patched in AntiSamy 1.7.5 and later. This is due to parsing behavior in the neko-htmlunit dependency, just by updating to a newer version the issue was solved. See important remediation details in the reference given below. Workarounds If you cannot upgrade to a fixed version of the library, the following mitigation can be applied until you can upgrade: Manually edit your AntiSamy policy file (e.g., antisamy.xml) by deleting the preserveComments directive or setting its value to false, if present. As the previously mentioned policy settings are preconditions for the mXSS attack to work, changing…
Recommended action: Upgrade to 1.7.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the preserveComments directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patches Patched in AntiSamy 1.7.4 and later. See important remediation details in the reference given below. Workarounds If you cannot upgrade to a fixed version of the library, the following mitigation can be applied until you can upgrade: Manually edit your AntiSamy policy file (e.g., antisamy.xml) by deleting the preserveComments directive or setting its value to false, if present. Also it would be useful to make AntiSamy remove the noscript tag by adding this in your tag definitions under the <tagrules node (or deleting it entirely if present): As the…
Recommended action: Upgrade to 1.7.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
Recommended action: Upgrade to 1.6.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OWASP AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Recommended action: Upgrade to 1.6.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
Recommended action: Upgrade to 1.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.
Recommended action: Upgrade to 1.5.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.
Recommended action: Upgrade to 1.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.