CVE-2024-23635

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patched in AntiSamy 1.7.5 and later.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-236369.8SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian pr CVE-2024-236374.9OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious CVE-2024-236386.5Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Servi CVE-2024-236397.8Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with s CVE-2024-23644.6A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file andro CVE-2024-236404.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripti CVE-2024-236417.5SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app CVE-2024-236424.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripti CVE-2024-236434.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripti CVE-2024-236448.1Trillium is a composable toolkit for building internet applications with async rust. In `trillium-http` prior to 0.3.12 and `trillium-client CVE-2024-236456.1GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.CVE-2024-236468.8Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from availabl