OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| owasp-modsecurity | java-html-sanitizer | = 20240325.1 | — | No fix listed | CNA |
| — | com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven) | 20240325.1 to before 20260101.1 | 20260101.1 | Patch available | GHSA-g9gq-3pfx-2gw2 |
- java-html-sanitizer Vendorowasp-modsecurity Affected = 20240325.1 Fixed in — No fix listed CNA
- com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven) Vendor— Affected 20240325.1 to before 20260101.1 Fixed in 20260101.1 Patch available GHSA-g9gq-3pfx-2gw2
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:owasp:java_html_sanitizer:20240325.1:*:*:*:*:*:*:* | 20240325.1 | Vulnerable | owasp-modsecurity |
- cpe:2.3:a:owasp:java_html_sanitizer:20240325.1:*:*:*:*:*:*:* Versions 20240325.1 Vulnerable ·owasp-modsecurity
Remediation
- Fix · GHSA-g9gq-3pfx-2gw2 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven) Fixed in 20260101.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
Not affected: 2 products
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66021
- 2026-10-03 Alias added: GHSA-g9gq-3pfx-2gw2
References
Other 5
- https://github.com/OWASP/java-html-sanitizer/issues/363
- https://github.com/OWASP/java-html-sanitizer/commit/4149cf02ba84db13e8e9d7ee1b01b3f47238e072
- https://github.com/OWASP/java-html-sanitizer/commit/b98cdf1cd5e156a6259b01aa8cdc7372c6efde1e
- https://github.com/OWASP/java-html-sanitizer/commit/d6e0463ed3b48777ecd187913ffdbe767508ff45
- https://github.com/OWASP/java-html-sanitizer
More owasp-modsecurity Java Html Sanitizer vulnerabilities
- TI-2021-18855 The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-66021 · CVE Program
- CVE-2025-66021 · NVD
- FIRST EPSS
- GHSA-g9gq-3pfx-2gw2 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-66021 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences