org.htmlunit/htmlunit vulnerabilities

Latest org.htmlunit/htmlunit CVEs

Newest publication first

1. CVE-2023-49093 HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL

   Published 2023-12-04

   High·CVSS 8.8

   HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0

2. CVE-2023-2798 Denial of service in HtmlUnit

   Published 2023-05-25

   High·CVSS 7.5

   Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.