{"id":"CVE-2025-23026","aliases":["GHSA-vh22-6c6h-rm8q"],"url":"https://o3.security/vulnerability/CVE-2025-23026","summary":"HTML templates containing Javascript template strings are subject to XSS in jte","details":"### Summary\nJte HTML templates with `script` tags or script attributes that include a Javascript template string (backticks) are subject to XSS.\n\n### Details\nThe `javaScriptBlock` and `javaScriptAttribute` methods in the `Escape` class ([source](https://github.com/casid/jte/blob/main/jte-runtime/src/main/java/gg/jte/html/escape/Escape.java#L43-L83)) do not escape backticks, which are used for Javascript [template strings](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#description). Dollar signs in template strings should also be escaped as well to prevent undesired interpolation.\n\n### PoC\n1. Use the [Jte Gradle Plugin](https://jte.gg/gradle-plugin/) with the following code in `src/jte/xss.jte`:\n ```html\n @param String someMessage\n \n \n \n XSS Test\n \n \n \n XSS Test
\n \n \n ```\n2. Use the following Java code to demonstrate the XSS vulnerability:\n ```java\n final StringOutput output = new StringOutput();\n JtexssGenerated.render(new OwaspHtmlTemplateOutput(output), null, \"` + alert(`xss`) + `\");\n renderHtml(output);\n ```\n\n### Impact\nHTML templates rendered by Jte's `OwaspHtmlTemplateOutput` in versions less than or equal to `3.1.15` with `script` tags or script attributes that contain Javascript template strings (backticks) are vulnerable.","published":"2025-01-13T19:36:03.286Z","modified":"2026-08-12T03:51:40.359418528Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"gg.jte:jte","fixedVersion":"3.1.16"},{"ecosystem":"Maven","name":"gg.jte:jte-runtime","fixedVersion":"3.1.16"}],"fix":{"url":"https://github.com/casid/jte/commit/a6fb00d53c7b8dbb86de933215dbe1b9191a57f1","label":"casid/jte@a6fb00d"},"references":[{"type":"WEB","url":"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#description"},{"type":"WEB","url":"https://github.com/casid/jte/blob/main/jte-runtime/src/main/java/gg/jte/html/escape/Escape.java#L43-L83"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23026.json"},{"type":"ADVISORY","url":"https://github.com/casid/jte/security/advisories/GHSA-vh22-6c6h-rm8q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23026"},{"type":"WEB","url":"https://github.com/casid/jte/commit/a6fb00d53c7b8dbb86de933215dbe1b9191a57f1"},{"type":"PACKAGE","url":"https://github.com/casid/jte"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.359418528Z"}}