CVE-2021-23899 Arbitrary code injection in json-sanitizer

Critical 9.8 Published 13 Jan 2021 Updated 3 Aug 2024

An attacker can inject arbitrary HTML or XML into embedding documents via crafted input, potentially leading to cross-site scripting attacks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-23899?

CVE-2021-23899 is a critical cross-site scripting vulnerability in n/a, published on 13 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.

Weakness: CWE-611

Which versions are affected by CVE-2021-23899?

2 open source packages ship an affected version, including com.mikesamuel:json-sanitizer. It affects 1 product.

Package	Affected	Fixed in
`com.mikesamuel:json-sanitizer` Maven	All versions	`1.2.2`
`com.mikesamuel:json-sanitizer` Maven	All versions	`1.2.2`

Products include Owasp Json-Sanitizer.

How do I fix CVE-2021-23899?

Upgrade com.mikesamuel:json-sanitizer to 1.2.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-23899 being exploited?

There is no known exploitation of CVE-2021-23899 in the wild and no public exploit code.

Sources

Also known as GHSA-mm8j-9x84-m9cv.