CVE-2025-66021 OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

🗓️ 26 Nov 2025 01:53:37Reported by GitHub_MType

OWASP Java HTML Sanitizer XSS via noscript and style allowTextIn in 20240325.1; no patch available.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: Cross-Site Scripting (XSS) Vulnerability in OWASP Java HTML Sanitizer via HtmlPolicyBuilder noscript/style Tags (v20240325.1), affects watsonx.data	8 Apr 202610:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	26 Feb 202610:04	–	ibm
Atlassian	DOM-based XSS com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer Dependency in Bamboo Data Center and Server	5 Feb 202621:27	–	atlassian
BDU FSTEC	The vulnerability of the HtmlPolicyBuilder class in the Java library for sanitizing HTML code from OWASP Java HTML Sanitizer allows a malicious actor to gain unauthorized access to confidential information.	31 Jul 202600:00	–	bdu_fstec
Chainguard	CVE-2025-66021 vulnerabilities	28 Jan 202601:17	–	cgr
Circl	CVE-2025-66021	25 Nov 202500:00	–	circl
CNNVD	Owasp Json-sanitizer 安全漏洞	26 Nov 202500:00	–	cnnvd
CVE	CVE-2025-66021	26 Nov 202501:53	–	cve
EUVD	EUVD-2025-199654	26 Nov 202501:53	–	euvd
Github Security Blog	OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization	25 Nov 202522:10	–	github

[
  {
    "vendor": "OWASP",
    "product": "java-html-sanitizer",
    "versions": [
      {
        "version": "= 20240325.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-g9gq-3pfx-2gw2

26 Nov 2025 01:53Current

CVSS 48.6

EPSS0.00253

CWE-79