CVE-2021-35043
Cross-site Scripting in OWASP AntiSamy
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Record
CVE-2021-35043- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Record
CVE-2021-35043- Updated
- 2026-11-02
EUVDEUVD-2021-1654 No score
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Record
EUVD-2021-1654- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9c8w-jrw3-q2c3
Cross-site Scripting in OWASP AntiSamy
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Record
GHSA-9c8w-jrw3-q2c3- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Record
CVE-2021-35043- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-35043
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Record
DEBIAN-CVE-2021-35043- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-9c8w-jrw3-q2c3
Cross-site Scripting in OWASP AntiSamy
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Record
GHSA-9c8w-jrw3-q2c3- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-35043
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Record
UBUNTU-CVE-2021-35043- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
- antisamy project antisamy
- netapp active iq unified manager
- oracle banking enterprise default management
- oracle banking enterprise default managment
- oracle banking party management
- oracle banking platform
- oracle insurance policy administration
- oracle middleware common libraries and tools
- oracle retail back office
- oracle retail central office
- oracle retail returns management
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.owasp.antisamy:antisamyMaven |
1.5.7 up to 1.6.4 | 1.6.4 |
libowasp-antisamy-javaDebian:12 |
All versions, plus listed versions 1.5.3+dfsg-1.11.7.4-1 |
None known |
libowasp-antisamy-javaDebian:13 |
before 1.7.4-1 | 1.7.4-1 |
libowasp-antisamy-javaDebian:14 |
before 1.7.4-1 | 1.7.4-1 |
org.owasp.antisamy:antisamyMaven |
1.5.7 up to 1.6.4, plus listed versions 1.5.101.5.111.5.121.5.131.5.8 Show 5 moreShow less1.5.91.6.01.6.11.6.21.6.3 |
1.6.4 |
libowasp-antisamy-javaUbuntu:16.04:LTS |
All versions, plus listed versions 1.5.3+dfsg-1 |
None known |
libowasp-antisamy-javaUbuntu:18.04:LTS |
All versions, plus listed versions 1.5.3+dfsg-1 |
None known |
libowasp-antisamy-javaUbuntu:20.04:LTS |
All versions, plus listed versions 1.5.3+dfsg-1 |
None known |
libowasp-antisamy-javaUbuntu:22.04:LTS |
All versions, plus listed versions 1.5.3+dfsg-1.1 |
None known |
libowasp-antisamy-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1.5.3+dfsg-1.11.7.4-1 |
None known |
libowasp-antisamy-javaUbuntu:25.10 |
All versions, plus listed versions 1.7.4-1 |
None known |
libowasp-antisamy-javaUbuntu:26.10 |
All versions, plus listed versions 1.7.4-1 |
None known |
libowasp-antisamy-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1.7.4-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-35043 is a medium vulnerability (CVSS 6.1) in Antisamy Project Antisamy, published July 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in org.owasp.antisamy:antisamy 1.6.4.