CVE-2022-29577: Cross-site Scripting in OWASP AntiSamy
Summary
CVE-2022-29577: Cross-site Scripting in OWASP AntiSamy. Affects org.owasp.antisamy:antisamy versions < 1.6.7. Fixed in 1.6.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OWASP AntiSamy is a library designed to cleanse HTML content from untrusted sources. It provides fast and configurable sanitization to prevent cross-site scripting (XSS) attacks. The library is commonly used in web applications to sanitize user-generated content and protect against malicious code injection. However, a vulnerability has been discovered in versions prior to 1.6.7 that allows for XSS attacks through HTML tag smuggling on STYLE content.
Vulnerability Detail
The vulnerability (CVE-2022-29577) in OWASP AntiSamy arises from a flaw in the output serializer, which fails to properly encode Cascading Style Sheets (CSS) content. This allows an attacker to inject malicious code into the STYLE tag, which can then be executed by unsuspecting users. The issue was introduced in version 0 of the library and was only partially fixed in subsequent versions, leading to the incomplete mitigation of the vulnerability. The impact of this vulnerability is moderate, with a CVSS score of 6.1. Exploitation of this vulnerability can result in unauthorized access, data theft, or the manipulation of user sessions.
How To Fix
Latest published version: 1.7.8 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of the OWASP AntiSamy library to ensure proper mitigation.
Conclusion
The vulnerability (CVE-2022-29577) in OWASP AntiSamy allows for cross-site scripting (XSS) attacks through HTML tag smuggling on STYLE content. It is crucial to upgrade to version 1.6.7 or later of the library to fully mitigate this vulnerability. Regularly monitoring for security updates and promptly applying patches is essential to protect against known vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.owasp.antisamy:antisamy →
FAQ
OWASP AntiSamy is a library that provides HTML sanitization to prevent cross-site scripting (XSS) attacks. It is commonly used in web applications to sanitize user-generated content.
The vulnerability allows for cross-site scripting (XSS) attacks, which can result in unauthorized access, data theft, or the manipulation of user sessions.
To fix this vulnerability, it is recommended to upgrade to version 1.6.7 or later of the OWASP AntiSamy library.
No, there is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of the OWASP AntiSamy library.
The CVSS score of this vulnerability is 6.1, indicating a moderate impact.
Related vulnerabilities
Recent vulnerabilities recorded for org.owasp.antisamy:antisamy.
