The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Vulnerability ID: GHSA-m8p2-495h-ccmh
Aliases: CVE-2019-10219
Published: 2020-01-08 17:01:52
CWE: CWE-79
Severity rating: MODERATE
CVSS: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven
name: org.hibernate.validator:hibernate-validator