OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with…
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Why it matters now
EPSS 0.01006 63rd percentileScored 2026-11-07
Fix Fixed org.owasp.antisamy:antisamy (Maven): 1.6.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.owasp.antisamy:antisamy (Maven) | before 1.6.6 | 1.6.6 | Patch available | GHSA-3pqg-4rqg-pg9g |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.owasp.antisamy:antisamy (Maven) Vendor— Affected before 1.6.6 Fixed in 1.6.6 Patch available GHSA-3pqg-4rqg-pg9g
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:antisamy_project:antisamy:*:*:*:*:*:*:*:* | before 1.6.6 | Vulnerable | Antisamy Project |
- cpe:2.3:a:antisamy_project:antisamy:*:*:*:*:*:*:*:* Versions before 1.6.6 Vulnerable ·Antisamy Project
Remediation
- Fix · GHSA-3pqg-4rqg-pg9g org.owasp.antisamy:antisamy (Maven) Fixed in 1.6.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-28367
- 2026-10-03 Alias added: GHSA-3pqg-4rqg-pg9g
References
More Antisamy Project Antisamy vulnerabilities
- TI-2022-11120 Certain Neko-related HTML parsers allow a denial of service via crafted Processing… CVSS 3.1HIGH 7.5
- TI-2016-08102 In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that… CVSS 3.1MEDIUM 6.1
- TI-2017-10799 OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of… CVSS 3.0MEDIUM 6.1
- TI-2022-12015 OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with… CVSS 3.1MEDIUM 6.1
- TI-2021-14007 OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output… CVSS 3.1MEDIUM 6.1
- TI-2023-23369 mXSS in AntiSamy CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-28367 · CVE Program
- CVE-2022-28367 · NVD
- FIRST EPSS
- GHSA-3pqg-4rqg-pg9g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences