CVE-2023-26119
HtmlUnit Code Injection vulnerability
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
- Record
CVE-2023-26119- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2023-1944
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
- Record
EUVD-2023-1944- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3xrr-7m6p-p7xh
HtmlUnit Code Injection vulnerability
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
- Record
GHSA-3xrr-7m6p-p7xh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74, CWE-94
- Updated
- 2026-11-02
NVD
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
- Record
CVE-2023-26119- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
- Record
CVE-2023-26119- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-3xrr-7m6p-p7xh
HtmlUnit Code Injection vulnerability
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
- Record
GHSA-3xrr-7m6p-p7xh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74, CWE-94
- Updated
- 2026-11-02
OSVCLSA-2025-1766534901 No score
TuxCare security update for net.sourceforge.htmlunit:htmlunit (1 CVE)
TuxCare rebuilt net.sourceforge.htmlunit:htmlunit to address 1 CVE. Fixed in 2.70.0-tuxcare.1.
- Record
CLSA-2025-1766534901- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2023-26119 No score
CVE-2023-26119 in io.root.net.sourceforge.htmlunit:htmlunit - Patched by Root
Root has patched CVE-2023-26119 in the io.root.net.sourceforge.htmlunit:htmlunit package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2023-26119- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
net.sourceforge.htmlunit:htmlunitMaven |
before 3.0.0 | 3.0.0 |
net.sourceforge.htmlunit:htmlunitTuxCare:Maven |
2.70.0 up to 2.70.0-tuxcare.1 | 2.70.0-tuxcare.1 |
net.sourceforge.htmlunit:htmlunitMaven |
before 3.0.0, plus listed versions 1.142.02.12.1.52.10 Show 45 moreShow less2.112.122.132.142.152.162.172.182.192.22.202.212.222.232.242.252.262.272.282.292.32.302.312.322.332.34.02.34.12.35.02.36.02.37.02.38.02.39.02.39.12.42.40.02.41.02.42.02.43.02.44.02.45.02.46.02.47.02.47.12.48.02.49.0 |
3.0.0 |
io.root.net.sourceforge.htmlunit:htmlunitRoot:Maven |
before 2.70.0-root.io.1 | 2.70.0-root.io.12.70.0-root.io.2 |
net.sourceforge.htmlunit:htmlunitRoot:Maven |
before 2.70.0-aikido.2 | 2.70.0-aikido.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-26119 is a critical vulnerability (CVSS 9.8) in Htmlunit, published April 3, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. Fixed in net.sourceforge.htmlunit:htmlunit 3.0.0.
References
security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEHTMLUNIT-3252500
github.com/HtmlUnit/htmlunit/commit/641325bbc84702dc9800ec7037aec061ce21956b
siebene.github.io/2022/12/30/HtmlUnit-RCE
nvd.nist.gov/vuln/detail/CVE-2023-26119
Left out here: 28 versions. The JSON record has them.