CVE-2022-29577
MEDIUM 6.1EPSS 1.3%
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 1.33% chance of exploitation in the next 30 days, 71st percentile
- Published
- 2022-04-21
- Updated
- 2026-10-08
Proof-of-concept exploits (1)
- shoucheng3/nahsra__antisamy_CVE-2022-29577_1-6-6-10★ · 2025-11-20
Security advisories
- https://www.oracle.com/security-alerts/cpujul2022.html
- advisories/GHSA-vp37-2f9p-3vr3
- nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0