CVE-2024-23635

    Dashboard / Vulnerabilities / CVE-2024-23635

    CVE-2024-23635

    Published: 2 Feb 2024Last Modified: 28 Oct 2026

    Summary: AntiSamy malicious input can provoke XSS when preserving comments

    Details: AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patched in AntiSamy 1.7.5 and later.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23635.json, https://github.com/nahsra/antisamy/security/advisories/GHSA-2mrq-w8pv-5pvq, https://nvd.nist.gov/vuln/detail/CVE-2024-23635

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -12a2e31d3855430c119480655c2bbbbb79a66ecd

    Affected versions

    v1.7.4
    v1.7.3
    v1.7.2
    v1.7.1
    v1.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-23635 | CVE-DB