Vulnerabilities

TI-2025-40547 CVE-2025-66021 · GHSA-g9gq-3pfx-2gw2

OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

HIGH 72

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00289 Published 2025-11-26 Partial fix · 20260101.1 CWE-79

TI-2021-18855 CVE-2021-42575 · GHSA-3w73-fmf3-hg5c

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies…

MEDIUM 47

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02975 Published 2021-10-18 Fixed in 20211018.1 CWE-20

Vulnerabilities

Filters

OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies…