HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL
Description
HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
HtmlUnit is vulnerable to Remote Code Execution via XSLT when browsing an attacker's webpage, patched in version 3.9.0.
HtmlUnit, a GUI-less browser for Java programs, is vulnerable to Remote Code Execution (RCE) via XSLT. The root cause is that the XSLT processor does not enable FEATURE_SECURE_PROCESSING, allowing arbitrary code execution [2][4].
Exploitation occurs when a user running HtmlUnit visits an attacker-controlled webpage. The page contains malicious JavaScript that uses ActiveXObject to load an XSLT stylesheet with Xalan Java extensions, which can execute arbitrary system commands [4].
An attacker can achieve full remote code execution in the context of the Java application using HtmlUnit, potentially leading to complete system compromise [2].
The vulnerability is patched in HtmlUnit version 3.9.0. Users are strongly advised to upgrade to this version or later [1][2][4].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.htmlunit:htmlunitMaven | < 3.9.0 | 3.9.0 |
Affected products
3Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-37vq-hr2f-g7h7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-49093ghsaADVISORY
- github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7ghsax_refsource_CONFIRMWEB
- www.htmlunit.org/changes-report.htmlghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.