CVE-2023-43643

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-436449.8Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent CVE-2023-436455.9OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of ser CVE-2023-436467.5get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 ar CVE-2023-436475.4baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload featur CVE-2023-436486.5baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission dat CVE-2023-436499.8baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content prev CVE-2023-43654.3Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a CVE-2023-436507.4JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to t CVE-2023-436519.9JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary comman CVE-2023-436529.1JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an CVE-2023-436549.8TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, e CVE-2023-436558.8Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be