JS Html Sanitizer allows XSS when used with contentEditable

Impact XSS vulnerability when the sanitizer is used with a contentEditable element to set the elements innerHTML to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. Patches Patched in version 2.0.3...

CVE-2025-29771

HtmlSanitizer (client-side HTML sanitizer) is affected: versions prior to 2.0.3 are vulnerable to cross-site scripting when used with a contentEditable element that sets innerHTML to a sanitized string. The issue is caused by the code beautifier running after sanitation, enabling XSS. remediation...

Linux Distros Unpatched Vulnerability : CVE-2023-23627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is...

CVE-2025-24028 Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Tex...

CVE-2025-24028 Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Tex...

CVE-2025-24028

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Tex...

CVE-2025-24028

The CVE-2025-24028 entry describes an XSS in Joplin affecting the Rich Text Editor and the Markdown viewer due to how Joplin’s HTML sanitizer handles comments versus how browsers treat them. The Markdown viewer is cross-origin isolated, so exploits cannot access the top-level window. The issue is...

CVE-2024-55630 DOM Clobbering leads to temporary DOS in the note viewer in Joplin

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the name attribute to be specified. If name is set to the same value as an existing document property e.g. querySelector, that propert...

CVE-2024-55630

CVE-2024-55630 concerns Joplin, an open source note-taking app. The issue arises in Joplin’s HTML sanitizer where the HTML5 name attribute can be set to the same value as an existing document property (for example, querySelector). When this happens, that property can be replaced with the element,...

CVE-2024-55630

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the "name" attribute to be specified. If "name" is set to the same value as an existing "document" property e.g. "querySelector", that...

CVE-2024-55630 DOM Clobbering leads to temporary DOS in the note viewer in Joplin

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the name attribute to be specified. If name is set to the same value as an existing document property e.g. querySelector, that propert...

CVE-2024-55630 DOM Clobbering leads to temporary DOS in the note viewer in Joplin

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the name attribute to be specified. If name is set to the same value as an existing document property e.g. querySelector, that propert...

Joplin 跨站脚本漏洞

Joplin is an open source note-taking and to-do list application from the individual developer Laurent Cozic. Joplin suffers from a cross-site scripting vulnerability that stems from a difference between the way HTML sanitizer handles comments and the way browsers handle comments, making it...

PT-2025-6009 · Joplin · Joplin

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 3.2.8 Description: Joplin is a free, open source note taking and to-do application. The HTML sanitizer in Joplin allows the name attribute to be specified, which can lead to a property replacement issue. If the name...

CVE-2025-24028: Improper Neutralization of Input During Web Page Generation

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Tex...

CVE-2024-55630: Improper Input Validation

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the name attribute to be specified. If name is set to the same value as an existing document property e.g. querySelector, that propert...

Internet Bug Bounty: #2931639 ActionView sanitize helper bypass with math-related tags

There is a vulnerability in Rails-HTML-Sanitizer 1.6.0, which is also used by Rails ActionView. The vulnerability allows for bypassing the sanitization process when certain math-related tags, such as "math", "mtext", "table", "style", and "mglyph" or "malignmark", are allowed. This could lead to...

Internet Bug Bounty: ActionView sanitize helper bypass with style

The Rails-html-sanitizer, which Rails ActionView also uses, failed to sanitize input when the style tag was allowed, leading to a potential XSS vulnerability. The vulnerability affected version 1.6.0 of the sanitizer and was addressed in version 1.6.1...

Internet Bug Bounty: ActionView sanitize helper bypass with style and math

The Rails-html-sanitizer version 1.6.0 was affected by a vulnerability that could lead to a bypass of the sanitization process, resulting in potential cross-site scripting XSS attacks. The vulnerability was addressed in version 1.6.1...

Internet Bug Bounty: ActionView sanitize helper bypass with noscript

The Rails-html-sanitizer 1.6.0 contained a vulnerability that allowed bypassing the sanitization process when the noscript tag was used. This could have led to potential cross-site scripting XSS attacks in applications that used the vulnerable version of the sanitizer, including those using the...