Arbitrary HTML/XML Injection in OWASP json-sanitizer (before 1.2.2)

CVE-2021-23899 · CRITICAL Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.

Learn more about our Web Application Penetration Testing UK.