Cross-site Scripting in Apache TomcatGHSA-6j88-6whg-x687
MEDIUMGHSA-6j88-6whg-x687 is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in org.apache.tomcat:tomcat. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for org.apache.tomcat:tomcat — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-6j88-6whg-x687.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
org.apache.tomcat:tomcat☕org.apache.tomcat:tomcat☕org.apache.tomcat:tomcat☕org.apache.tomcat:tomcatReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.apache.tomcat:tomcat | ≥ 10.1.0-M1&&< 10.1.0-M17 | 10.1.0-M17org.apache.tomcat:tomcat:10.1.0-M17 |
| ☕Maven | org.apache.tomcat:tomcat | ≥ 10.0.0-M1&&< 10.0.22 | 10.0.22org.apache.tomcat:tomcat:10.0.22 |
| ☕Maven | org.apache.tomcat:tomcat | ≥ 9.0.30&&< 9.0.65 | 9.0.65org.apache.tomcat:tomcat:9.0.65 |
| ☕Maven | org.apache.tomcat:tomcat | ≥ 8.5.50&&< 8.5.82 | 8.5.82org.apache.tomcat:tomcat:8.5.82 |
Affected Products
tomcatapacheResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.tomcat:tomcat, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.apache.tomcat:tomcat to 10.1.0-M17 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-6j88-6whg-x687 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
How to detect GHSA-6j88-6whg-x687
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id ghsa-6j88-6whg-x687 -u https://target- Template
- Apache Tomcat Examples Web Application - Cross-Site Scripting
- Severity
- medium
- Impact
- Attackers can execute malicious scripts in victim browsers, leading to session hijacking, defacement, or redirection.
- Remediation
- Update to the latest version of Apache Tomcat where this issue is fixed.
Template by ProjectDiscovery nuclei-templates (Sourabh-Sahu), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is GHSA-6j88-6whg-x687 in your dependencies?
Find it across Maven, including transitive dependencies.