CVE-2023-26119: HtmlUnit Code Injection vulnerability
Summary
CVE-2023-26119: HtmlUnit Code Injection vulnerability. Affects net.sourceforge.htmlunit:htmlunit versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
HtmlUnit is a Java library for simulating web browsing and automating web interactions. It provides a way to interact with web pages programmatically, allowing developers to perform tasks such as form submission, page navigation, and JavaScript execution. Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker's webpage.
Vulnerability Detail
The vulnerability in HtmlUnit allows an attacker to execute arbitrary code remotely by exploiting a code injection vulnerability via XSTL. This can be achieved by tricking a user into visiting a malicious webpage. The attacker can then inject malicious code into the victim's browser, leading to potential unauthorized access, data theft, or further compromise of the system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 2.70.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible to protect against potential attacks.
Conclusion
In conclusion, the net.sourceforge.htmlunit:htmlunit package versions prior to 3.0.0 are vulnerable to a critical code injection vulnerability. It is crucial to update to the fixed version of the package to mitigate the risk of remote code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for net.sourceforge.htmlunit:htmlunit →
FAQ
HtmlUnit is a Java library for simulating web browsing and automating web interactions. It allows developers to interact with web pages programmatically.
This vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to unauthorized access, data theft, or further compromise of the system.
To fix this vulnerability, upgrade the net.sourceforge.htmlunit:htmlunit package to version 3.0.0 or later.
No, there is no known workaround. It is essential to update to the fixed version of the package.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
Related vulnerabilities
Recent vulnerabilities recorded for net.sourceforge.htmlunit:htmlunit.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
