HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL
SummaryHtmlUnit 3.8.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpageDetailsVulnerability code location:
org.htmlunit.activex.javascript.msxml.XSLProcessor#transform(org.htmlunit.activex.javascript.msxml.XMLDOMNode)The reason for the vulnerability is that it was not enabled FEATURE_SECURE_PROCESSING for the XSLT processorPoCpom.xml:code:test.html:ImpactRemote Code Execution