CVE-2021-23899: Owasp JSON-Sanitizer

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.

Affected products

• Owasp JSON-Sanitizer: before 1.2.2 (fixed in 1.2.2)

Published 2021-01-13. Last modified 2026-06-17.