TI-2023-23369 Aliases CVE-2023-43643 GHSA-pcf2-gh6g-h5r2

mXSS in AntiSamy

LOW 28CWE-79Published 2023-10-09 · Updated 2024-09-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00541 45th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed org.owasp.antisamy:antisamy (Maven): 1.7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nahsra	antisamy	up to 1.7.3	—	No fix listed	CNA
—	org.owasp.antisamy:antisamy (Maven)	before 1.7.4	1.7.4	Patch available	GHSA-pcf2-gh6g-h5r2

antisamy Vendornahsra Affected up to 1.7.3 Fixed in — No fix listed CNA
org.owasp.antisamy:antisamy (Maven) Vendor— Affected before 1.7.4 Fixed in 1.7.4 Patch available GHSA-pcf2-gh6g-h5r2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:antisamy_project:antisamy::::::::	before 1.7.4	Vulnerable	Antisamy Project

cpe:2.3:a:antisamy_project:antisamy:*:*:*:*:*:*:*:* Versions before 1.7.4 Vulnerable ·Antisamy Project

Remediation

Fix · GHSA-pcf2-gh6g-h5r2 org.owasp.antisamy:antisamy (Maven) Fixed in 1.7.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-43643
2026-10-03 Alias added: GHSA-pcf2-gh6g-h5r2

References

TI-2022-11120 Certain Neko-related HTML parsers allow a denial of service via crafted Processing… CVSS 3.1HIGH 7.5
TI-2016-08102 In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that… CVSS 3.1MEDIUM 6.1
TI-2017-10799 OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of… CVSS 3.0MEDIUM 6.1
TI-2022-12015 OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with… CVSS 3.1MEDIUM 6.1
TI-2021-14007 OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output… CVSS 3.1MEDIUM 6.1
TI-2022-11121 OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with… CVSS 3.1MEDIUM 6.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences