{"id":"CVE-2023-4241","aliases":["EUVD-2023-2267","GHSA-c3x7-354f-4p2x"],"status":"published","title":"lol-html panics on certain HTML inputs","description":"lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00687,"percentile":0.53136,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2023-08-09T13:17:53Z","modified":"2026-10-28T02:30:37Z","fixes":[{"ecosystem":"crates.io","package":"lol-html","fixed_in":["1.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"lol-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"lol-html","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]}],"products":[{"vendor":"cloudflare","product":"lol-html"}],"references":[{"url":"https://github.com/cloudflare/lol-html/security/advisories/GHSA-c3x7-354f-4p2x","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4241","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c3x7-354f-4p2x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4241.json","tags":["advisory"]},{"url":"https://github.com/cloudflare/lol-html","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-4241","title":"lol-html panics on certain HTML inputs","description":"lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.\n\n","status":"published","published":"2023-08-16T10:13:12.564Z","modified":"2024-10-02T16:12:50.008Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:30.474787Z"}],"euvd":[{"id":"EUVD-2023-2267","description":"lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.\n\n","status":"published","published":"2023-08-16T10:13:12Z","modified":"2024-10-02T16:12:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:27:57.62634Z"}],"ghsa":[{"id":"GHSA-c3x7-354f-4p2x","title":"lol-html panics on certain HTML inputs","description":"### Impact\nlol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.\n\n### Patches\nThe problem has been patched and released as v1.1.1\n\n### Workarounds\nNo workarounds exist.\n","status":"published","published":"2023-08-09T13:17:53Z","modified":"2023-11-09T05:05:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:18.40412Z"}],"nvd":[{"id":"CVE-2023-4241","description":"lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.\n\n","status":"published","published":"2023-08-16T11:15:11.377Z","modified":"2026-06-17T06:37:23.387Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:08:24.487686Z"}],"osv":[{"id":"CVE-2023-4241","title":"lol-html panics on certain HTML inputs","description":"lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.\n\n","status":"published","published":"2023-08-16T10:13:12.564Z","modified":"2026-10-28T02:30:37.179807856Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GHSA-c3x7-354f-4p2x","title":"lol-html panics on certain HTML inputs","description":"### Impact\nlol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.\n\n### Patches\nThe problem has been patched and released as v1.1.1\n\n### Workarounds\nNo workarounds exist.\n","status":"published","published":"2023-08-09T13:17:53Z","modified":"2026-07-08T06:52:55.828055732Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:44.571161Z"}]}}