CVE-2021-23899: 
Java vulnerability analysis and mitigation

OWASP json-sanitizer before version 1.2.2 contains a vulnerability that allows attackers to inject arbitrary HTML or XML into embedding documents. The vulnerability (CVE-2021-23899) was discovered through fuzzing by Fabian Meumertzheim of Code Intelligence and was disclosed on January 13, 2021 (Google Blog, MITRE).

The vulnerability exists in the json-sanitizer library's handling of closing SCRIPT tags and CDATA section delimiters for crafted input. When processing specially crafted input, the library may emit these dangerous elements, which can lead to cross-site scripting (XSS) attacks in embedding documents (JSON Support).

The vulnerability allows attackers to inject arbitrary HTML or XML into embedding documents, potentially leading to cross-site scripting (XSS) attacks. This could enable attackers to execute malicious scripts in the context of the affected application, potentially compromising user data or performing unauthorized actions (JSON Support).

The vulnerability was discovered through fuzzing techniques, specifically using Jazzer in OSS-Fuzz. The issue can be exploited by providing specially crafted input to applications using vulnerable versions of the json-sanitizer library (Google Blog).

Users should update to json-sanitizer version 1.2.2 or later, which contains fixes for this vulnerability. The fixed version is available on Maven Central repository (JSON Support).