CVE-2023-5896: XSS in pkp-lib Open Journal Systems

The XSS vulnerability allows an attacker to inject arbitrary JavaScript code into the pkp-lib application. This code could be executed in the context of a victim's browser when they visit a compromised page. An attacker could leverage this to steal session cookies, redirect users to malicious websites, or deface the application. The stored nature of the XSS means the malicious script persists until removed, potentially affecting multiple users over time. While the CVSS score is LOW, the potential for session hijacking and data theft warrants prompt remediation.

1. Reserved2023-11-01
2. Published2023-11-01
3. Modified2025-02-27
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-5896 is to upgrade to version 3.4.0-4 or later of pkp-lib. If an immediate upgrade is not feasible, consider implementing input validation and output encoding on user-supplied data to prevent script injection. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Review and sanitize any user-generated content within the pkp-lib application to identify and remove potentially malicious scripts. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple script and verifying it is not executed.