CVE-2025-66021 OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

🗓️ 26 Nov 2025 01:53:37Reported by GoogleType

osv

osv🔗 osv.dev👁 7 Views

OWASP Java HTML Sanitizer 20240325.1 has XSS noscript and style tag sanitization gaps.

Reporter	Title	Published	Views	Family All 23
IBM Security Bulletins	Security Bulletin: Cross-Site Scripting (XSS) Vulnerability in OWASP Java HTML Sanitizer via HtmlPolicyBuilder noscript/style Tags (v20240325.1), affects watsonx.data	8 Apr 202610:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	26 Feb 202610:04	–	ibm
Atlassian	DOM-based XSS com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer Dependency in Bamboo Data Center and Server	5 Feb 202621:27	–	atlassian
Chainguard	CVE-2025-66021 vulnerabilities	28 Jan 202601:17	–	cgr
Circl	CVE-2025-66021	25 Nov 202500:00	–	circl
CNNVD	Owasp Json-sanitizer 安全漏洞	26 Nov 202500:00	–	cnnvd
CVE	CVE-2025-66021	26 Nov 202501:53	–	cve
Cvelist	CVE-2025-66021 OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization	26 Nov 202501:53	–	cvelist
EUVD	EUVD-2025-199654	26 Nov 202501:53	–	euvd
Github Security Blog	OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization	25 Nov 202522:10	–	github

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66021.json
github	www.github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-g9gq-3pfx-2gw2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-66021

10 Apr 2026 05:35Current

6Medium risk

Vulners AI Score6

CVSS 48.6

EPSS0.00217

owasp java sanitizer noscript tag style tag cross site scripting vulnerability version 20240325.1