Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

owasp.antisamy

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1NuGetPublished

    OWASP.AntiSamy mXSS when preserving comments

    CVE-2023-51652 · GHSA-8x6f-956f-q43w

    Affected
    • NuGet owasp.antisamy < 1.2.0
    Fixed in
    1.2.0· Vendor fix available
    Issue
    Impact There is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the preserveComments directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patches Patched in OWASP AntiSamy .NET 1.2.0 and later. See important remediation details in the reference given below. Workarounds If you cannot upgrade to a fixed version of the library, the following mitigation can be applied until you can upgrade: Manually edit your AntiSamy policy file (e.g., antisamy.xml) by deleting the preserveComments directive or setting its value to false, if present. Also it would be useful to make AntiSamy remove the noscript tag by adding this in your tag definitions under the <tagrules node (or deleting it entirely if present):…

    Recommended action: Upgrade to 1.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →