CVE-2021-23899: XEE
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-23899?
CVE-2021-23899 is a vulnerability in OWASP json-sanitizer before version 1.2.2 that allows an attacker to inject arbitrary HTML or XML into embedding documents.
How severe is CVE-2021-23899?
CVE-2021-23899 is rated as critical with a severity value of 9.8.
Which software is affected by CVE-2021-23899?
OWASP json-sanitizer versions up to but excluding 1.2.2 are affected by CVE-2021-23899.
How can an attacker exploit CVE-2021-23899?
An attacker can exploit CVE-2021-23899 by providing crafted input that results in the emission of closing SCRIPT tags and CDATA section delimiters by the json-sanitizer library.
How can I fix CVE-2021-23899?
To fix CVE-2021-23899, update to version 1.2.2 or later of the OWASP json-sanitizer library.