CVE-2021-23899 is a critical vulnerability affecting OWASP json-sanitizer versions prior to 1.2.2, allowing attackers to inject arbitrary HTML or XML into embedding documents due to improper handling of crafted input that can emit closing SCRIPT tags and CDATA section delimiters. With a CVSS score of 9.8, this vulnerability presents a severe risk, as it can be exploited remotely with low attack complexity and no user interaction, leading to high impacts on confidentiality, integrity, and availability. Despite its critical severity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.2.2CPE matchmatch criteria | cpe:2.3:a:owasp:json-sanitizer:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.