GHSA-mm8j-9x84-m9cv

Arbitrary code injection in json-sanitizer

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23899

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.mikesamuel:json-sanitizer	< 1.2.2	1.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23899 advisory
https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e web
https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2 web
https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0 web