CVE-2026-43892: Antswordproject Antsword

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection. This vulnerability is fixed in 2.1.16.

Affected products

• Antswordproject Antsword: before 2.1.16 (fixed in 2.1.16)

Published 2026-05-12. Last modified 2026-06-17.