CVE-2023-26119

CriticalCVSS 9.8

Published: 03/04/2023(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.51%

84th percentile - higher than 84% of all known CVEs

Summary

Vulnerability in the package net.sourceforge.htmlunit:htmlunit before version 3.0.0 allows remote code execution (RCE) via XSTL when browsing the attacker's webpage.

Risk Assessment

An attacker can gain control over the system running the application using HtmlUnit, potentially leading to full compromise.

Recommendation

Update the htmlunit package to version 3.0.0 or later.

Other vulnerabilities in HtmlUnit

CVE-2022-29546High
The NekoHtml parser in HtmlUnit before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption; this is similar to CVE-2022-28366 but affects a much later version of the product.

Original NVD description (English source)

Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS