CVE-2022-42466: Apache Isis

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered.

Affected products

• Apache Isis: before 2.0.0 (fixed in 2.0.0); version 2.0.0 only

Published 2022-10-19. Last modified 2026-06-17.