CVE-2021-42575

9.8 criticalEPSS 3.0%

Critical (9.8). EPSS 3.0% chance of exploitation in the next 30 days. Fixed in com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer 20211018.1.

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
Published: 2021-10-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

oracle:middleware_common_libraries_and_tools
oracle:primavera_unifier
owasp:java_html_sanitizer

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-3w73-fmf3-hg5c	Maven	com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer	<20211018.1	20211018.1

References

https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/
https://www.oracle.com/security-alerts/cpujan2022.html

Check your stack JSON