CVE catalog

CVE-2024-23635

libowasp-antisamy-java: CVE-2024-23635

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.37% · Oct 25, 2026

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patched in AntiSamy 1.7.5 and later.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibowasp-antisamy-javasid1.7.8-1fixed
Debianlibowasp-antisamy-javaforky1.7.4-1vulnerable
Debianlibowasp-antisamy-javatrixie1.7.4-1vulnerable
Debianlibowasp-antisamy-javabookworm1.5.3+dfsg-1.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibowasp-antisamy-javasourcesid1.7.8-1not yet assignedNot reported[1062846]
Debianlibowasp-antisamy-javasourceforky(unfixed)not yet assignedNot reported[1062846]
Debianlibowasp-antisamy-javasourcetrixie(unfixed)not yet assignedNot reported[1062846]
Debianlibowasp-antisamy-javasourcebookworm(unfixed)not yet assignedNot reported[1062846]

[Debian bug #1062846]

Notes

[trixie] libowasp-antisamy-java: Minor issue [bookworm] libowasp-antisamy-java: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]