CVE-2023-41889
Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue.
Does this matter?
Lower severity and a low EPSS score (0.71%). Track it; it rarely justifies an emergency change on its own.
Description
SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happens when a logical validation or a security check is performed before a Unicode normalization. The Unicode character equivalent of a character would resurface after the normalization. The fix is initially performing the Unicode normalization and then strip for all whitespaces and then checking for a blank string. This issue has been fixed in version 1.18.0.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.71% probability · 53th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-176, CWE-116
- Affected
- ss-proj/shirasagi
- Source
- security-advisories@github.com
EPSS 0.7% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/shirasagi/shirasagi/blob/f249ce3f06f6bfbc0017b38f5c13de424334c3ea/app/models/concerns/rdf/object.rb#L68-L72Product
- https://github.com/shirasagi/shirasagi/security/advisories/GHSA-xr45-c2jv-2v9rExploit, Mitigation, Vendor Advisory
- https://sim4n6.beehiiv.com/p/unicode-characters-bypass-security-checksExploit, Third Party Advisory
- https://github.com/shirasagi/shirasagi/blob/f249ce3f06f6bfbc0017b38f5c13de424334c3ea/app/models/concerns/rdf/object.rb#L68-L72Product
- https://github.com/shirasagi/shirasagi/security/advisories/GHSA-xr45-c2jv-2v9rExploit, Mitigation, Vendor Advisory
- https://sim4n6.beehiiv.com/p/unicode-characters-bypass-security-checksExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.