Cross-site scripting in Java HTML Sanitizer - #VU152247
Published: September 25, 2026
Vulnerability identifier: #VU152247
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and modify web page content.
The vulnerability exists due to improper neutralization of input during web page generation in StylingPolicy URL handling when processing URLs in style attributes. A remote attacker can provide a URL containing quotes, backslashes, or control characters to disclose sensitive information and modify web page content.
User interaction is required.
Affected software
Java HTML Sanitizer
Remediation
Install security update from vendor's website.
Java HTML Sanitizer - update to 20260922.1