What is GHSA-mm8j-9x84-m9cv?

GHSA-mm8j-9x84-m9cv is a security advisory published by GitHub Security Advisories with Critical severity. Arbitrary code injection in json-sanitizer

Which CVE IDs does GHSA-mm8j-9x84-m9cv cover?

GHSA-mm8j-9x84-m9cv covers the following CVE IDs: CVE-2021-23899. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mm8j-9x84-m9cv?

GHSA-mm8j-9x84-m9cv has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mm8j-9x84-m9cv?

GHSA-mm8j-9x84-m9cv affects 1 product, including: maven/com.mikesamuel:json-sanitizer:\u003c 1.2.2.

GHSA-mm8j-9x84-m9cvCriticalCVSS 9.8

Arbitrary code injection in json-sanitizer

Vendor

GitHub Security Advisories

Published

June 16, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-23899 →

📋 Description

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.

🎯 Affected products1

maven/com.mikesamuel:json-sanitizer:< 1.2.2

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-23899
https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e
https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2
https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0
https://github.com/advisories/GHSA-mm8j-9x84-m9cv