AIKIDO-2025-10244

citeproc-java is vulnerable to Cross-site Scripting (XSS)

Cross-site Scripting (XSS) Pre-CVE Published Apr 17, 2025

Low Risk

This Affects:

citeproc-java

3.0.0 - 3.2.0

Fixed in 3.2.1

Are you affected? Scan for Free

TL;DR

Affected versions of the package allow Cross-site Scripting (XSS) when rendering links in the HtmlFormat:doFormatLink function.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

citeproc-java is vulnerable to Cross-site Scripting (XSS) in versions 3.0.0 - 3.2.0.

How to fix this

Upgrade the de.undercouch:citeproc-java library to the patch version.

Low Risk

This Affects:

citeproc-java

3.0.0 - 3.2.0

Fixed in 3.2.1

Are you affected? Scan for Free

Links

github.com/michel-kraemer/citeproc-java/releases/tag/3.2.1

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Scan for Free

Book a Demo

Free. No credit card required.

Company

Resources

Industries

Use Cases

Compare

Legal

Connect

hello@aikido.dev

Security

Stay up to date with all updates

I consent to receiving marketing communications based on Aikido’s Privacy Policy.

LinkedIn YouTube X

Keizer Karelstraat 15, 9000, Ghent, Belgium

95 Third St, 2nd Fl, San Francisco, CA 94103, US

Unit 6.15 Runway East 18 18 Crucifix Ln, London SE1 3JW UK

Ghent, Belgium | San Francisco, US