Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

OWASP Java HTML Sanitizer can allow cross-site scripting

CVE-2025-66021 · published 11 months ago
Summary

The Java HTML Sanitizer library used to clean user‑generated HTML can be tricked into running malicious code when certain noscript or style elements are allowed. This means an attacker could inject harmful scripts into a web page that displays user content. Update to a fixed version as soon as it is released or remove the risky tag allowances until a patch is available.

What to do
  • Update googlecode com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer to version 20260101.1.
  • Update com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer to version 20240325.1-aikido.1.
  • Update io.root.com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer to version 20240325.1-root.io.1.
Affected software
Ecosystem VendorProductAffected versions
maven googlecode com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer 20240325.1
Fix: upgrade to 20260101.1
– owasp java_html_sanitizer 20240325.1
cpe:2.3:a:owasp:java_html_sanitizer:20240325.1:*:*:*:*:*:*:*
Root:Maven – com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer < 20240325.1-aikido.1
Fix: upgrade to 20240325.1-aikido.1
Root:Maven – io.root.com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer < 20240325.1-root.io.1
Fix: upgrade to 20240325.1-root.io.1
Original advisory text
OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization
OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published26 Nov 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-g9gq-3pfx-2gw2 · GHSA
CVE-2025-66021 · NVD
ROOT-APP-MAVEN-CVE-2025-66021 · OSV
CVE-2025-66021 · OSV
Track software like this
Free during beta