Maven/gg.jte:jte CVE-2025-23026: medium 6.1, EPSS 0.30%
jte's HTML templates containing Javascript template strings are subject to XSS
Action: Upgrade gg.jte:jte to 3.1.16 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.1.16 | - |
Fixed versions
| 3.1.16 |
Sources
- osv: GHSA-vh22-6c6h-rm8q
- https://github.com/casid/jte/security/advisories/GHSA-vh22-6c6h-rm8q
- https://nvd.nist.gov/vuln/detail/CVE-2025-23026
- https://github.com/casid/jte/commit/a6fb00d53c7b8dbb86de933215dbe1b9191a57f1
- https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#description
- https://github.com/casid/jte
- https://github.com/casid/jte/blob/main/jte-runtime/src/main/java/gg/jte/html/escape/Escape.java#L43-L83
CVE-2025-23026 · published · modified · JSON