{"id":"CVE-2022-28367","aliases":["DEBIAN-CVE-2022-28367","EUVD-2022-1609","GHSA-3pqg-4rqg-pg9g","UBUNTU-CVE-2022-28367"],"status":"published","title":"Cross-site Scripting in OWASP AntiSamy","description":"OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01006,"percentile":0.63247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-04-21T22:42:14Z","modified":"2026-11-03T06:02:29Z","fixes":[{"ecosystem":"Maven","package":"org.owasp.antisamy:antisamy","fixed_in":["1.6.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"libowasp-antisamy-java","fixed_in":["1.7.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libowasp-antisamy-java","fixed_in":["1.7.4-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.owasp.antisamy:antisamy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3+dfsg-1.1","1.7.4-1","1.7.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.owasp.antisamy:antisamy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6"}]}],"versions":["1.4.2","1.4.3","1.4.4","1.4.5","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.2","1.5.3","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3+dfsg-1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3+dfsg-1.1","1.7.4-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libowasp-antisamy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.4-1"]}],"products":[{"vendor":"antisamy_project","product":"antisamy"}],"references":[{"url":"https://github.com/nahsra/antisamy/releases/tag/v1.6.6","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Third Party Advisory","web","report"]},{"url":"https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28367","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3pqg-4rqg-pg9g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28367.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-28367","tags":["advisory"]},{"url":"https://github.com/nahsra/antisamy","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-28367","tags":["report"]},{"url":"https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28367","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-28367","description":"OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.","status":"published","published":"2022-04-21T22:42:14Z","modified":"2024-08-03T05:56:14.935Z","updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-1609","description":"OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.","status":"published","published":"2022-04-21T22:42:14Z","modified":"2024-08-03T05:56:14Z","updated_at":"2026-11-03T03:25:41.002Z"}],"ghsa":[{"id":"GHSA-3pqg-4rqg-pg9g","title":"Cross-site Scripting in OWASP AntiSamy","description":"OWASP AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.","status":"published","published":"2022-04-23T00:03:04Z","modified":"2023-01-27T05:02:02Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2022-28367","description":"OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.","status":"published","published":"2022-04-21T23:15:10.427Z","modified":"2026-06-17T04:38:26.397Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:16.9948Z"}],"osv":[{"id":"GHSA-3pqg-4rqg-pg9g","title":"Cross-site Scripting in OWASP AntiSamy","description":"OWASP AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.","status":"published","published":"2022-04-23T00:03:04Z","modified":"2023-11-08T04:09:04.310082Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"UBUNTU-CVE-2022-28367","description":"OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.","status":"published","published":"2022-04-21T23:15:00Z","modified":"2026-10-17T12:56:21.67798331Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CVE-2022-28367","description":"OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.","status":"published","published":"2022-04-21T22:42:14Z","modified":"2026-10-28T10:28:04.209522975Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"DEBIAN-CVE-2022-28367","description":"OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.","status":"published","published":"2022-04-21T23:15:10.427Z","modified":"2026-11-03T06:02:29.766809982Z","updated_at":"2026-11-03T06:44:05.456691Z"}]}}