~ / search / GHSA-5mh9-r3rr-9597

GHSA-5mh9-r3rr-9597

Code execution vulnerability in HtmlUnit

Source: GitHub Advisory Database (reviewed) High CVE-2020-5529

Packages

EcosystemPackageAffectedFixed in
Maven net.sourceforge.htmlunit:htmlunit < 2.37.0 2.37.0

Details

As written in the advisory (Markdown source, shown as plain text).

HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.

References

External links from the advisory. They lead to third-party sites.