CVE-2023-43643: mXSS in AntiSamy
Summary
CVE-2023-43643: mXSS in AntiSamy. Affects org.owasp.antisamy:antisamy versions < 1.7.4. Fixed in 1.7.4. How to fix ↓
Also tracked for
- libowasp-antisamy-java · Debian:11
The same CVE-2023-43643 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AntiSamy is an open-source library that provides protection against cross-site scripting (XSS) attacks by sanitizing HTML input. It is commonly used in web applications to prevent malicious code execution. However, a vulnerability has been discovered in AntiSamy that allows for a mutation XSS (mXSS) attack. This vulnerability occurs when the preserveComments directive is enabled in the policy file and certain tags are allowed. As a result, crafted inputs can be interpreted as executable code, leading to potential security breaches.
Vulnerability Detail
The mXSS vulnerability in AntiSamy can be exploited by attackers to execute malicious code. By manipulating the HTML input and taking advantage of the flawed parsing mechanism, an attacker can inject executable elements within comment tags. This can lead to various consequences, such as unauthorized data access, session hijacking, or the injection of malware. The vulnerability has a CVSS score of 6.1, indicating a moderate level of severity.
How To Fix
Latest published version: 1.7.8 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version of AntiSamy is not immediately feasible, a temporary workaround can be applied. This involves manually editing the AntiSamy policy file (e.g., antisamy.xml) by either deleting the preserveComments directive or setting its value to false. Additionally, you can add the following code snippet to remove the noscript tag in the tag definitions:
<tag name="noscript" action="remove"/>
While this workaround can mitigate the vulnerability, it is recommended to upgrade to a fixed version as soon as possible to address the root cause.
Conclusion
The mXSS vulnerability in AntiSamy poses a moderate security risk, allowing attackers to execute malicious code. It is crucial to upgrade to a fixed version of AntiSamy (1.7.4 or later) to address this vulnerability. In the meantime, applying the provided workaround can provide temporary protection. For further assistance and guidance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.owasp.antisamy:antisamy →
FAQ
AntiSamy is an open-source library used for sanitizing HTML input to prevent cross-site scripting (XSS) attacks. It helps protect web applications from malicious code execution.
Mutation XSS (mXSS) is a type of cross-site scripting attack where the attacker manipulates the input in a way that the injected code is interpreted as executable. In the case of AntiSamy, this vulnerability allows for mXSS attacks by exploiting flawed parsing of HTML input.
The mXSS vulnerability in AntiSamy can be exploited by crafting inputs that contain executable elements within comment tags. By enabling the preserveComments directive in the policy file and allowing certain tags, the attacker can execute malicious code.
The mXSS vulnerability can lead to various security breaches, including unauthorized data access, session hijacking, and the injection of malware. Attackers can exploit this vulnerability to execute arbitrary code within the context of the affected application.
To protect your application from the mXSS vulnerability, it is recommended to upgrade to AntiSamy version 1.7.4 or later. Regularly updating your dependencies and following secure coding practices can help mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for org.owasp.antisamy:antisamy.
