In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that…
Priority LOW 32CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.
Why it matters now
EPSS 0.02354 83rd percentileScored 2026-11-07
Fix Fixed org.owasp.antisamy:antisamy (Maven): 1.5.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.owasp.antisamy:antisamy (Maven) | before 1.5.5 | 1.5.5 | Patch available | GHSA-683w-6h9j-57wq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.owasp.antisamy:antisamy (Maven) Vendor— Affected before 1.5.5 Fixed in 1.5.5 Patch available GHSA-683w-6h9j-57wq
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:antisamy_project:antisamy:*:*:*:*:*:*:*:* | before 1.5.5 | Vulnerable | Antisamy Project |
- cpe:2.3:a:antisamy_project:antisamy:*:*:*:*:*:*:*:* Versions before 1.5.5 Vulnerable ·Antisamy Project
Remediation
- Fix · GHSA-683w-6h9j-57wq org.owasp.antisamy:antisamy (Maven) Fixed in 1.5.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2016-10006
- 2026-10-03 Alias added: GHSA-683w-6h9j-57wq
References
More Antisamy Project Antisamy vulnerabilities
- TI-2022-11120 Certain Neko-related HTML parsers allow a denial of service via crafted Processing… CVSS 3.1HIGH 7.5
- TI-2017-10799 OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of… CVSS 3.0MEDIUM 6.1
- TI-2022-12015 OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with… CVSS 3.1MEDIUM 6.1
- TI-2021-14007 OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output… CVSS 3.1MEDIUM 6.1
- TI-2022-11121 OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with… CVSS 3.1MEDIUM 6.1
- TI-2023-23369 mXSS in AntiSamy CVSS 3.1MEDIUM 6.1
Sources
- CVE-2016-10006 · CVE Program
- CVE-2016-10006 · NVD
- FIRST EPSS
- GHSA-683w-6h9j-57wq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences