Description
HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HtmlUnit | htmlunit | < 3.9.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | htmlunit | 2.8-3ubuntu1+esm1 | — |
| Ubuntu Pro 16.04 LTS | htmlunit | 2.8-1ubuntu2.1+esm1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.htmlunit:htmlunit | < 3.9.0 | 3.9.0 | GHSA-37vq-hr2f-g7h7 |
Advisories 1
- WID-SEC-2024-0123 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 7, 2026