HTML templates containing Javascript template strings are subject to XSS in jte

published 2025-01-13 21 mo ago modified 2026-06-17 4 mo ago also GHSA-vh22-6c6h-rm8q , EUVD-2025-0046

cvss: 6.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits: 0; none known

jte (Java Template Engine) is a secure and lightweight template engine for Java and Kotlin. In affected versions Jte HTML templates with `script` tags or script attributes that include a Javascript template string (backticks) are subject to XSS. The `javaScriptBlock` and `javaScriptAttribute` methods in the `Escape` class do not escape backticks, which are used for Javascript template strings. Dollar signs in template strings should also be escaped as well to prevent undesired interpolation. HTML templates rendered by Jte's `OwaspHtmlTemplateOutput` in versions less than or equal to `3.1.15` with `script` tags or script attributes that contain Javascript template strings (backticks) are vulnerable. Users are advised to upgrade to version 3.1.16 or later to resolve this issue. There are no known workarounds for this vulnerability.

Patch / fix

fixed in 2 links 1

maven gg.jte:jte 3.1.16
maven gg.jte:jte-runtime 3.1.16

github.com/casid/jte@a6fb00d commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 21 mo ago (2025-01-13)

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/casid/jte/security/advisories/GHSA-vh22-6c6h-rm8q referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	gg.jte:jte	<3.1.16	3.1.16
maven	gg.jte:jte-runtime	<3.1.16	3.1.16

Affected products

casid jte

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary