CVE-2025-15599, CVE-2026-0540

Data: 2026-03-09

Severity: MEDIUM

CVSS Score: 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N)

Riferimenti: - https://nvd.nist.gov/vuln/detail/CVE-2025-15599 - https://nvd.nist.gov/vuln/detail/CVE-2026-0540

Libreria: org.webjars:swagger-ui

Descrizione

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 729097f, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Falso Positivo per GovWay

Swagger UI viene disabilitato nelle API di GovWay (proprietà “support.swagger.ui=false” nel file openapi-configuration.json) e si può quindi considerare un falso positivo.

Configuration File: false-positive.xml