CVE-2026-43892: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in AntSwordProject antSword
CVE-2026-43892 is a high-severity vulnerability in AntSword, a cross-platform website management toolkit. Versions prior to 2. 1. 16 suffer from incomplete input sanitization in the noxss() function, which allows an attacker to perform a one-click remote code execution (RCE) via jquery. terminal format code injection. This vulnerability is fixed in version 2. 1. 16. The CVSS score is 8. 8, indicating a significant risk if exploited.
AI Analysis
Technical Summary
AntSword versions before 2.1.16 contain a cross-site scripting (CWE-79) vulnerability due to incomplete sanitization of input during web page generation. This flaw allows attackers to inject malicious code through jquery.terminal format strings, leading to remote code execution with user interaction. The vulnerability is addressed in AntSword 2.1.16, which includes a fix for the noxss() sanitization function.
Potential Impact
Successful exploitation can lead to remote code execution with high impact on confidentiality, integrity, and availability. An attacker can execute arbitrary code on the affected system by exploiting the improper input sanitization. This poses a critical risk to systems running vulnerable versions of AntSword prior to 2.1.16.
Mitigation Recommendations
Upgrade AntSword to version 2.1.16 or later, where the vulnerability is fixed. Since the vendor advisory confirms the fix in 2.1.16, applying this official update is the recommended remediation. No additional mitigation guidance is provided or required beyond applying the update.
CVE-2026-43892: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in AntSwordProject antSword
Description
CVE-2026-43892 is a high-severity vulnerability in AntSword, a cross-platform website management toolkit. Versions prior to 2. 1. 16 suffer from incomplete input sanitization in the noxss() function, which allows an attacker to perform a one-click remote code execution (RCE) via jquery. terminal format code injection. This vulnerability is fixed in version 2. 1. 16. The CVSS score is 8. 8, indicating a significant risk if exploited.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
AntSword versions before 2.1.16 contain a cross-site scripting (CWE-79) vulnerability due to incomplete sanitization of input during web page generation. This flaw allows attackers to inject malicious code through jquery.terminal format strings, leading to remote code execution with user interaction. The vulnerability is addressed in AntSword 2.1.16, which includes a fix for the noxss() sanitization function.
Potential Impact
Successful exploitation can lead to remote code execution with high impact on confidentiality, integrity, and availability. An attacker can execute arbitrary code on the affected system by exploiting the improper input sanitization. This poses a critical risk to systems running vulnerable versions of AntSword prior to 2.1.16.
Mitigation Recommendations
Upgrade AntSword to version 2.1.16 or later, where the vulnerability is fixed. Since the vendor advisory confirms the fix in 2.1.16, applying this official update is the recommended remediation. No additional mitigation guidance is provided or required beyond applying the update.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-04T15:17:09.330Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a036fd1cbff5d86100ccd21
Added to database: 5/12/2026, 6:22:09 PM
Last enriched: 5/12/2026, 6:36:43 PM
Last updated: 5/12/2026, 9:49:01 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.