Description
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Critical · 9.8
Known exploited CVE-2022-42948
EUVD-2022-46004GHSA-c8qh-hq9w-qh3p
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is p…
Published Mar 24, 2023 · Updated Oct 21, 2025 · Assigned by mitre