CVE-2022-28367

MEDIUM

OWASP AntiSamy <1.6.6 - XSS

Title source: llm

Description

OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

Exploits (1)

References (2)

Scores

CVSS v3 6.1
EPSS 0.0022
EPSS Percentile 44.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
antisamy_project/antisamy < 1.6.6
org.owasp.antisamy/antisamy 0 - 1.6.6Maven
Published Apr 21, 2022
Tracked Since Feb 18, 2026