SB20260925258 - Cross-site scripting in Java HTML Sanitizer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260925258

SB20260925258 - Cross-site scripting in Java HTML Sanitizer

Published: September 25, 2026

Security Bulletin ID SB20260925258
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script.

The vulnerability exists due to failure to apply attribute and URL policies in the stripDisallowedTags function when sanitizing untrusted HTML using policies that allow text in style or script elements. A remote attacker can submit crafted HTML containing allowed elements with dangerous attributes or URLs to execute arbitrary script.

Only custom policies that allow a style or script element and use allowTextIn are affected; prepackaged Sanitizers policies are not affected.


Remediation

Install update from vendor's website.

References