What is GHSA-x83m-pf6f-pf9g?

GHSA-x83m-pf6f-pf9g is a security advisory published by GitHub Security Advisories with Medium severity. hibernate-validator Cross-site Scripting vulnerability

Which CVE IDs does GHSA-x83m-pf6f-pf9g cover?

GHSA-x83m-pf6f-pf9g covers the following CVE IDs: CVE-2023-1932. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x83m-pf6f-pf9g?

GHSA-x83m-pf6f-pf9g has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-x83m-pf6f-pf9g?

GHSA-x83m-pf6f-pf9g affects 2 products, including: maven/org.hibernate.validator:hibernate-validator:\u003c 6.2.0.Final; maven/org.hibernate:hibernate-validator:\u003c 6.2.0.Final.

GHSA-x83m-pf6f-pf9gMediumCVSS 6.1

hibernate-validator Cross-site Scripting vulnerability

Vendor

GitHub Security Advisories

Published

November 7, 2024

Last Modified

September 12, 2025

🔗 CVE IDs covered (1)

CVE-2023-1932 →

📋 Description

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.

🎯 Affected products2

maven/org.hibernate.validator:hibernate-validator:< 6.2.0.Final
maven/org.hibernate:hibernate-validator:< 6.2.0.Final

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-1932
https://access.redhat.com/security/cve/CVE-2023-1932
https://bugzilla.redhat.com/show_bug.cgi?id=1809444
https://github.com/advisories/GHSA-x83m-pf6f-pf9g