Read the docs
TI-2026-31956 Aliases CVE-2026-43892

AntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection

Priority MEDIUM 40CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection. This vulnerability is fixed in 2.1.16.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Fixed antSword (AntSwordProject): 2.1.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AntSwordProjectantSwordbefore 2.1.162.1.16Patch availableCNA
  • antSword VendorAntSwordProject Affected before 2.1.16 Fixed in 2.1.16 Patch available CNA

Remediation

  • Fix · CNA antSword (AntSwordProject) Fixed in 2.1.16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43892

References

Other 1

  • TI-2020-13467 A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands. CVSS 3.1CRITICAL 9.6
  • TI-2019-10419 In antSword before 2.1.0, self-XSS in the database configuration leads to code execution… CVSS 3.0MEDIUM 6.1
  • TI-2020-15566 AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences