cve.bz

CVE-2020-13973

6.1 mediumEPSS 1.1%

Medium (6.1) in owasp json-sanitizer. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in com.mikesamuel:json-sanitizer 1.2.1.

OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g8jj-899q-8x3jMavencom.mikesamuel:json-sanitizer<1.2.11.2.1

References

Check your stackJSON