PT-2026-40329 · Antsword · Antsword

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-43892

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AntSword versions prior to 2.1.16

Description Incomplete sanitization in the noxss() function allows for 1-click Remote Code Execution (RCE) through jquery.terminal format code injection.

Recommendations Update to version 2.1.16. As a temporary workaround, restrict the use of the noxss() function until the update is applied.

Fix

RCE

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-1188

CWE-94

Related Identifiers

CVE-2026-43892

Affected Products

Antsword

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-43892 · Security Note
• https://github.com/AntSwordProject/antSword/security/advisories/GHSA-c63g-p4cp-r45x · Note
• https://twitter.com/CVEnew/status/2054340975875547483 · Twitter Post
• https://t.me/CVEtracker/53532 · Telegram Post