CVE-2025-23026

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-23026
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23026.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-23026
Aliases
Published
2025-01-13T19:36:03.286Z
Modified
2026-04-02T12:45:25.832221Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
HTML templates containing Javascript template strings are subject to XSS in jte
Details

jte (Java Template Engine) is a secure and lightweight template engine for Java and Kotlin. In affected versions Jte HTML templates with script tags or script attributes that include a Javascript template string (backticks) are subject to XSS. The javaScriptBlock and javaScriptAttribute methods in the Escape class do not escape backticks, which are used for Javascript template strings. Dollar signs in template strings should also be escaped as well to prevent undesired interpolation. HTML templates rendered by Jte's OwaspHtmlTemplateOutput in versions less than or equal to 3.1.15 with script tags or script attributes that contain Javascript template strings (backticks) are vulnerable. Users are advised to upgrade to version 3.1.16 or later to resolve this issue. There are no known workarounds for this vulnerability.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23026.json",
    "cwe_ids": [
        "CWE-150",
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/casid/jte

Affected ranges

Type
GIT
Repo
https://github.com/casid/jte
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d50dce8119b7a50bfb6fa1b8d655f74251d313f9
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.1.16"
        }
    ]
}

Affected versions

0.*
0.1.1
0.2.0
0.3.0
0.4.0
0.5.0
0.6.0
0.7.0
0.8.0
1.*
1.0.0
1.1.0
1.10.0
1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
1.12.0
1.12.1
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.8.0
1.9.0
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.1.2
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.6
2.3.0
2.3.1
2.3.2
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23026.json"