CVE-2022-28367

medium

Description

OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

References

Advisories
More

https://github.com/nahsra/antisamy/releases/tag/v1.6.6

https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae

https://github.com/advisories/GHSA-3pqg-4rqg-pg9g

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1609

Details

Source: Mitre, NVD

Published: 2022-04-21

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N