Read the docs
TI-2022-21623 Aliases CVE-2022-43996GHSA-xxfx-w2rw-gh63

The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as…

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories (JSON format) to be uploaded with Content-Type text/html and filenames ending in .html. When subsequently accessed via web browser, these advisories are served and interpreted as HTML pages. Such uploaded advisories can contain JavaScript code that will execute within the browser context of users inspecting the advisory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00484 41st percentileScored 2026-11-07
Fix Fixed github.com/csaf-poc/csaf_distribution (Go): 0.8.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/csaf-poc/csaf_distribution (Go)before 0.8.20.8.2Patch availableGHSA-xxfx-w2rw-gh63
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/csaf-poc/csaf_distribution (Go) Vendor— Affected before 0.8.2 Fixed in 0.8.2 Patch available GHSA-xxfx-w2rw-gh63

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:csaf_provider_project:csaf_provider:*:*:*:*:*:*:*:*before 0.8.2VulnerableCsaf Provider Project
  • cpe:2.3:a:csaf_provider_project:csaf_provider:*:*:*:*:*:*:*:* Versions before 0.8.2 Vulnerable ·Csaf Provider Project

Remediation

  • Fix · GHSA-xxfx-w2rw-gh63 github.com/csaf-poc/csaf_distribution (Go) Fixed in 0.8.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43996
  2. 2026-10-03 Alias added: GHSA-xxfx-w2rw-gh63

References

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences