CVE-2023-26119
Critical · CVSS 9.8- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-94, NVD-CWE-noinfo
Description
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
Affected packages
| Maven | net.sourceforge.htmlunit:htmlunit | 0 → 3.0.0 |
References
- https://github.com/HtmlUnit/htmlunit/commit/641325bbc84702dc9800ec7037aec061ce21956b
- https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEHTMLUNIT-3252500
- https://siebene.github.io/2022/12/30/HtmlUnit-RCE/
- https://github.com/HtmlUnit/htmlunit/commit/641325bbc84702dc9800ec7037aec061ce21956b
- https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEHTMLUNIT-3252500
- https://siebene.github.io/2022/12/30/HtmlUnit-RCE/
Status: profiled · ingested 2026-10-09T00:00:43.000Z