CVE-2023-1932
Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Record
CVE-2023-1932- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-3327
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Record
EUVD-2024-3327- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x83m-pf6f-pf9g
hibernate-validator Cross-site Scripting vulnerability
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Record
GHSA-x83m-pf6f-pf9g- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Record
CVE-2023-1932- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Record
CVE-2023-1932- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-1932
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Record
DEBIAN-CVE-2023-1932- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-x83m-pf6f-pf9g
hibernate-validator Cross-site Scripting vulnerability
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Record
GHSA-x83m-pf6f-pf9g- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-1932
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
- Record
UBUNTU-CVE-2023-1932- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1773965923 No score
TuxCare security update for org.hibernate:hibernate-validator (2 CVEs)
TuxCare rebuilt org.hibernate:hibernate-validator to address 2 CVEs. Fixed in 5.4.3.Final-tuxcare.2.
- Record
CLSA-2026-1773965923- Updated
- 2026-11-02
OSVCLSA-2026-1792693332 No score
TuxCare security update for 2 packages (1 CVE)
TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 6.0.17.Final-tuxcare.3.
- Record
CLSA-2026-1792693332- Updated
- 2026-11-02
OSVCLSA-2026-1793879213 No score
TuxCare security update for org.hibernate:hibernate-validator (1 CVE)
TuxCare rebuilt org.hibernate:hibernate-validator to address 1 CVE. Fixed in 5.0.0.Final-tuxcare.1.
- Record
CLSA-2026-1793879213- Updated
- 2026-11-06
Affected products
- hibernate hibernate-validator
- red hat a-mq clients 2
- red hat cryostat 2
- red hat a-mq online
- red hat amq broker 7
- red hat bpm suite 6
- red hat codeready studio 12
- red hat data grid 8
- red hat decision manager 7
- red hat fuse 7
- red hat jboss brms 5
- red hat jboss data grid 7
Show 20 moreShow less
- red hat jboss data virtualization 6
- red hat jboss enterprise application platform 5
- red hat jboss enterprise application platform 6
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform continuous delivery
- red hat jboss fuse 6
- red hat jboss fuse service works 6
- red hat jboss operations network 3
- red hat jboss soa platform 5
- red hat openstack platform 10 (newton)
- red hat openstack platform 13 (queens)
- red hat process automation 7
- red hat satellite 6
- red hat single sign-on 7
- red hat support for spring boot
- red hat streams for apache kafka
- redhat codeready studio
- redhat jboss enterprise application platform
- redhat openstack platform
- redhat single sign-on
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.hibernate.validator:hibernate-validatorMaven |
before 6.2.0.Final | 6.2.0.Final |
org.hibernate:hibernate-validatorMaven |
before 6.2.0.Final | 6.2.0.Final |
org.hibernate:hibernate-validatorTuxCare:Maven From an advisory covering 2 CVEs |
5.4.3.Final up to 5.4.3.Final-tuxcare.2, plus listed versions 5.4.3.Final-tuxcare.1 |
5.4.3.Final-tuxcare.2 |
org.hibernate.validator:hibernate-validatorTuxCare:Maven |
6.0.17.Final up to 6.0.17.Final-tuxcare.3, plus listed versions 6.0.17.Final-tuxcare.16.0.17.Final-tuxcare.2 |
6.0.17.Final-tuxcare.3 |
org.hibernate:hibernate-validatorTuxCare:Maven |
6.0.17.Final up to 6.0.17.Final-tuxcare.3, plus listed versions 6.0.17.Final-tuxcare.16.0.17.Final-tuxcare.2 |
6.0.17.Final-tuxcare.3 |
org.hibernate:hibernate-validatorTuxCare:Maven |
5.0.0.Final up to 5.0.0.Final-tuxcare.1 | 5.0.0.Final-tuxcare.1 |
libhibernate-validator-javaDebian:12 |
All versions, plus listed versions 5.3.6-25.3.6-3 |
None known |
libhibernate-validator-javaDebian:13 |
All versions, plus listed versions 5.3.6-3 |
None known |
libhibernate-validator-javaDebian:14 |
All versions, plus listed versions 5.3.6-3 |
None known |
org.hibernate.validator:hibernate-validatorMaven |
before 6.2.0.Final, plus listed versions 6.0.0.Alpha16.0.0.Alpha26.0.0.Beta16.0.0.Beta26.0.0.CR1 Show 41 moreShow less6.0.0.CR26.0.0.CR36.0.0.Final6.0.1.Final6.0.10.Final6.0.11.Final6.0.12.Final6.0.13.Final6.0.14.Final6.0.15.Final6.0.16.Final6.0.17.Final6.0.18.Final6.0.19.Final6.0.2.Final6.0.20.Final6.0.21.Final6.0.22.Final6.0.23.Final6.0.3.Final6.0.4.Final6.0.5.Final6.0.6.Final6.0.7.Final6.0.8.Final6.0.9.Final6.1.0.Alpha16.1.0.Alpha26.1.0.Alpha36.1.0.Alpha46.1.0.Alpha56.1.0.Alpha66.1.0.Final6.1.1.Final6.1.2.Final6.1.3.Final6.1.4.Final6.1.5.Final6.1.6.Final6.1.7.Final6.2.0.CR1 |
6.2.0.Final |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.hibernate:hibernate-validatorMaven |
before 6.2.0.Final, plus listed versions 3.0.0.GA3.0.0.ga3.1.0.CR13.1.0.CR23.1.0.GA Show 45 moreShow less4.0.0.Alpha14.0.0.Alpha24.0.0.Alpha34.0.0.Beta14.0.0.Beta24.0.0.Beta34.0.0.CR14.0.0.GA4.0.1.GA4.0.2.GA4.1.0.Beta14.1.0.Beta24.1.0.CR14.1.0.Final4.2.0.Beta14.2.0.Beta24.2.0.CR14.2.0.Final4.3.0.Alpha14.3.0.Beta14.3.0.CR14.3.0.Final4.3.1.Final4.3.2.Final5.0.0.Alpha15.0.0.Alpha25.0.0.Beta15.0.0.CR15.0.0.CR25.0.0.CR35.0.0.CR45.0.0.CR55.0.0.Final5.0.1.Final5.0.2.Final5.0.3.Final5.1.0.Alpha15.1.0.Beta15.1.0.CR15.1.0.Final5.1.1.Final5.1.2.Final5.1.3.Final5.2.0.Alpha15.2.0.Beta1 |
6.2.0.Final |
libhibernate-validator-javaUbuntu:16.04:LTS |
All versions, plus listed versions 4.2.1-2 |
None known |
libhibernate-validator-javaUbuntu:18.04:LTS |
All versions, plus listed versions 4.3.3-24.3.3-34.3.3-44.3.4-1~18.04.1 |
None known |
libhibernate-validator-javaUbuntu:20.04:LTS |
All versions, plus listed versions 4.3.4-15.3.6-1 |
None known |
libhibernate-validator-javaUbuntu:22.04:LTS |
All versions, plus listed versions 5.3.6-1 |
None known |
libhibernate-validator-javaUbuntu:24.04:LTS |
All versions, plus listed versions 5.3.6-2 |
None known |
libhibernate-validator-javaUbuntu:25.10 |
All versions, plus listed versions 5.3.6-3 |
None known |
libhibernate-validator-javaUbuntu:26.10 |
All versions, plus listed versions 5.3.6-3 |
None known |
libhibernate-validator-javaUbuntu:26.04:LTS |
All versions, plus listed versions 5.3.6-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-1932 is a medium vulnerability (CVSS 6.1) in Hibernate Hibernate-validator, published November 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in org.hibernate.validator:hibernate-validator 6.2.0.Final.
References
Left out here: 68 versions. The JSON record has them.