CVE-2023-43643

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later.

• CWE-79

• https://github.com/nahsra/antisamy/releases/tag/v1.7.4Patch
• https://github.com/nahsra/antisamy/security/advisories/GHSA-pcf2-gh6g-h5r2Exploit, Mitigation, Product, Vendor Advisory
• https://github.com/nahsra/antisamy/releases/tag/v1.7.4Patch
• https://github.com/nahsra/antisamy/security/advisories/GHSA-pcf2-gh6g-h5r2Exploit, Mitigation, Product, Vendor Advisory

Published

Oct 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43636 In EVE OS, the “measured boot” mechanism prevents a compr…8.8
• CVE-2023-43637 Due to the implementation of "deriveVaultKey", prior to ver…7.8
• CVE-2023-4364Inappropriate implementation in Permission Prompts in Google…4.3
• CVE-2023-43640TaxonWorks is a web-based workbench designed for taxonomists…6.5
• CVE-2023-43641libcue provides an API for parsing and extracting data from …8.8
• CVE-2023-43642snappy-java is a Java port of the snappy, a fast C++ compres…7.5
• CVE-2023-43644Sing-box is an open source proxy system. Affected versions a…9.8
• CVE-2023-43645OpenFGA is an authorization/permission engine built for deve…5.9
• CVE-2023-43646get-func-name is a module to retrieve a function's name secu…7.5
• CVE-2023-43647baserCMS is a website development framework. Prior to versio…5.4
• CVE-2023-43648baserCMS is a website development framework. Prior to versio…6.5
• CVE-2023-43649baserCMS is a website development framework. Prior to versio…9.8