CVE-2016-10006: OWASP AntiSamy vulnerable to Cross-site Scripting

October 18, 2018 (updated April 14, 2025)

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.

References

github.com/advisories/GHSA-683w-6h9j-57wq
github.com/nahsra/antisamy
github.com/nahsra/antisamy/issues/2
nvd.nist.gov/vuln/detail/CVE-2016-10006
web.archive.org/web/20170214025813/http://www.securityfocus.com/bid/95101
web.archive.org/web/20201207192053/http://www.securitytracker.com/id/1037532

Code Behaviors & Features

Detect and mitigate CVE-2016-10006 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →