VulnerabilityPublished 15 Nov 2023Updated 29 Sep 2025

CVE-2023-48199: HTML Injection

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.5% chance of exploitation in 30 days – higher than 42% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Nov 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate this vulnerability, organizations should immediately update Grocy to a version where this issue is patched once available. In the meantime, administrators can implement strict input validation and output encoding on all user-supplied data, especially in the 'manageApiKeys' component and QR code detail popup. Employing a Content Security Policy (CSP) that restricts the execution of inline scripts and limits resource loading can reduce the risk of exploitation. Additionally, educating users about the potential for deceptive content and encouraging cautious interaction with unexpected or suspicious UI elements can help mitigate social engineering risks. Monitoring application logs for unusual input patterns or attempts to inject HTML content may also aid in early detection. If feasible, restricting access to the API key management interface to trusted users and networks will reduce the attack surface. Finally, contributing to or following updates from the Grocy community and security advisories will ensure timely application of fixes.

Description

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker can then manipulate page content in the QR code detail popup, often coupled with social engineering tactics, exploiting both the trust of users and the application's lack of proper input handling.

Impact

For European organizations using Grocy for inventory or household management, this vulnerability poses a risk primarily to the integrity and trustworthiness of the user interface. Although it does not allow script execution, the ability to inject arbitrary HTML can facilitate social engineering attacks that may lead to unauthorized actions, data disclosure, or user confusion. For example, attackers could craft deceptive content in the QR code popup to trick users into revealing sensitive information or performing unsafe operations. This is particularly concerning in environments where Grocy is used in shared or multi-user settings, such as small businesses, community kitchens, or institutional facilities. The impact on confidentiality and availability is limited since no direct code execution or system compromise is enabled by this flaw. However, the manipulation of UI elements can indirectly lead to security breaches if users are deceived into unsafe behaviors. Given Grocy's open-source nature and growing adoption in Europe, organizations relying on it should be aware of this vulnerability to maintain operational security and user trust.

References

Community reviews

Loading reviews…