CVE-2023-41889

SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happens when a logical validation or a security check is performed before a Unicode normalization. The Unicode character equivalent of a character would resurface after the normalization. The fix is initially performing the Unicode normalization and then strip for all whitespaces and then checking for a blank string. This issue has been fixed in version 1.18.0.

• CWE-176
• CWE-116

• https://github.com/shirasagi/shirasagi/blob/f249ce3f06f6bfbc0017b38f5c13de424334c3ea/app/models/concerns/rdf/object.rb#L68-L72Product
• https://github.com/shirasagi/shirasagi/security/advisories/GHSA-xr45-c2jv-2v9rExploit, Mitigation, Vendor Advisory
• https://sim4n6.beehiiv.com/p/unicode-characters-bypass-security-checksExploit, Third Party Advisory
• https://github.com/shirasagi/shirasagi/blob/f249ce3f06f6bfbc0017b38f5c13de424334c3ea/app/models/concerns/rdf/object.rb#L68-L72Product
• https://github.com/shirasagi/shirasagi/security/advisories/GHSA-xr45-c2jv-2v9rExploit, Mitigation, Vendor Advisory
• https://sim4n6.beehiiv.com/p/unicode-characters-bypass-security-checksExploit, Third Party Advisory

Published

Sep 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41882vantage6 is privacy preserving federated learning infrastruc…4.3
• CVE-2023-41884ZoneMinder is a free, open source Closed-circuit television …6.5
• CVE-2023-41885Piccolo is an ORM and query builder which supports asyncio. …5.3
• CVE-2023-41886OpenRefine is a powerful free, open source tool for working …7.5
• CVE-2023-41887OpenRefine is a powerful free, open source tool for working …9.8
• CVE-2023-41888GLPI stands for Gestionnaire Libre de Parc Informatique is a…5.4
• CVE-2023-4189Cross-site Scripting (XSS) - Reflected in GitHub repository …4.8
• CVE-2023-41890Sustainsys.Saml2 library adds SAML2P support to ASP.NET web …7.5
• CVE-2023-41891FlyteAdmin is the control plane for Flyte responsible for ma…8.8
• CVE-2023-41892Craft CMS is a platform for creating digital experiences. Th…9.8
• CVE-2023-41893Home assistant is an open source home automation. The audit …5.4
• CVE-2023-41894Home assistant is an open source home automation. The assess…5.3