Medium
libowasp-antisamy-java — security advisory
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
- Products
- libowasp-antisamy-java
- Affected versions
- 1.5.3+dfsg-1, 1.5.3+dfsg-1.1, 1.7.4-1
- Fixed versions
- Not specified
- CVEs
- CVE-2022-28367
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:01 UTC · Revision 1
Source evidence
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
osv:UBUNTU-CVE-2022-28367
libowasp-antisamy-java
Fixed versions: Not specified
libowasp-antisamy-java
Fixed versions: Not specified
libowasp-antisamy-java
Fixed versions: Not specified
libowasp-antisamy-java
Fixed versions: Not specified
libowasp-antisamy-java
Fixed versions: Not specified
libowasp-antisamy-java
Fixed versions: Not specified
libowasp-antisamy-java
Fixed versions: Not specified
libowasp-antisamy-java
Fixed versions: Not specified
Complete source record
{
"id": "6618bdcb187e86ccfacdaf8850f23663e83841c7ad4b8349ab645fdef42d40d5",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-28367",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2022-28367",
"summary": "OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.",
"evidence": "osv:UBUNTU-CVE-2022-28367",
"products": [
{
"name": {
"value": "libowasp-antisamy-java",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.3+dfsg-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libowasp-antisamy-java",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.3+dfsg-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libowasp-antisamy-java",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.3+dfsg-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "libowasp-antisamy-java",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.3+dfsg-1.1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "libowasp-antisamy-java",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.5.3+dfsg-1.1",
"evidence": "/affected/4/versions"
},
{
"value": "1.7.4-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "libowasp-antisamy-java",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.4-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "libowasp-antisamy-java",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.4-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "libowasp-antisamy-java",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.7.4-1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2022-28367",
"aliases": [
"UBUNTU-CVE-2022-28367"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libowasp-antisamy-java",
"purl": "pkg:deb/ubuntu/libowasp-antisamy-java?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.5.3+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-28367.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libowasp-antisamy-java",
"binary_version": "1.5.3+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libowasp-antisamy-java",
"purl": "pkg:deb/ubuntu/libowasp-antisamy-java?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.5.3+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-28367.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libowasp-antisamy-java",
"binary_version": "1.5.3+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libowasp-antisamy-java",
"purl": "pkg:deb/ubuntu/libowasp-antisamy-java?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.5.3+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-28367.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libowasp-antisamy-java",
"binary_version": "1.5.3+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libowasp-antisamy-java",
"purl": "pkg:deb/ubuntu/libowasp-antisamy-java?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.5.3+dfsg-1.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-28367.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libowasp-antisamy-java",
"binary_version": "1.5.3+dfsg-1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libowasp-antisamy-java",
"purl": "pkg:deb/ubuntu/libowasp-antisamy-java?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.5.3+dfsg-1.1",
"1.7.4-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-28367.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libowasp-antisamy-java",
"binary_version": "1.7.4-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libowasp-antisamy-java",
"purl": "pkg:deb/ubuntu/libowasp-antisamy-java?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.7.4-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-28367.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libowasp-antisamy-java",
"binary_version": "1.7.4-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libowasp-antisamy-java",
"purl": "pkg:deb/ubuntu/libowasp-antisamy-java?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.7.4-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-28367.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libowasp-antisamy-java",
"binary_version": "1.7.4-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libowasp-antisamy-java",
"purl": "pkg:deb/ubuntu/libowasp-antisamy-java?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.7.4-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-28367.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libowasp-antisamy-java",
"binary_version": "1.7.4-1"
}
]
}
}
],
"modified": "2026-10-17T12:56:21.677983310Z",
"provider": "osv",
"upstream": [
"CVE-2022-28367"
],
"references": [
"https://ubuntu.com/security/CVE-2022-28367",
"https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae",
"https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0",
"https://github.com/nahsra/antisamy/releases/tag/v1.6.6",
"https://www.cve.org/CVERecord?id=CVE-2022-28367"
]
},
"related_cves": [
{
"value": "CVE-2022-28367",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 355414,
"published_at": "2022-04-21T23:15:00+00:00"
}