What’s Vulnerable › Vulnerabilities

CVE-2024-23635: AntiSamy malicious input can provoke XSS when preserving comments

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-02 · updated 2026-06-17
• Weakness: CWE-79

Description

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patched in AntiSamy 1.7.5 and later.

Affected products

• nahsra antisamy: before 1.7.5 — fixed in 1.7.5

How to fix

Upgrade to a fixed version: nahsra antisamy 1.7.5. Check the vendor advisory for mitigations.

References

• https://github.com/nahsra/antisamy/security/advisories/GHSA-2mrq-w8pv-5pvq
• https://github.com/nahsra/antisamy/security/advisories/GHSA-2mrq-w8pv-5pvq

Get alerted when CVE-2024-23635 or the next vulnerability affects your stack