OWASPBugBounty

OWASP Bug Bounty for Projects Introduction Many developers and companies looking to implement security are turning towards OWASP to use Defender libraries that they can implement to secure their critical applications. Since this implies a form of trust in OWASP, many users of these projects might...

java-html-sanitizer

OWASP Java HTML Sanitizer A fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS. The existing dependency is on JSR 305. The other jars are only needed by the test suite. The JSR 305...

java-html-sanitizer v20260921.1

OWASP Java HTML Sanitizer A fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS. The existing dependency is on JSR 305. The other jars are only needed by the test suite. The JSR 305...

ROOT-APP-MAVEN-CVE-2025-66021 CVE-2025-66021 in com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer - Patched by Root

Root has patched CVE-2025-66021 in the com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer package for Root:Maven. Multiple fixed versions available...

OWASP Java HTML Sanitizer Unauthorized Access Disclosure

The vulnerability of the HtmlPolicyBuilder class in the Java library for sanitizing HTML code from OWASP Java HTML Sanitizer is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorize...

CVE-2025-66021

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style...

CVE-2025-66021 OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style...

CVE-2025-66021

The CVE-2025-66021 entry concerns OWASP Java HTML Sanitizer (version 20240325.1). The vulnerability arises when HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag, enabling XSS if crafted payloads bypass CSS sanitization and include unallowed tags. Public detai...

EUVD-2025-199654

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style...

CVE-2025-66021

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=8.0.0, <=8.6.8), ca.uhn.hapi.fhir:hapi-fhir-docs (>=8.0.0, <=8.6.8) +333 more potentially affected by CVE-2025-66021 via com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (20240325.1)

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer MAVEN version 20240325.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer and may be impacted: -...

CVE-2025-66021 OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style...

CVE-2025-66021: Improper Neutralization of Input During Web Page Generation

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=8.0.0, <=8.6.8), ca.uhn.hapi.fhir:hapi-fhir-docs (>=8.0.0, <=8.6.8) +333 more potentially affected by CVE-2025-66021 via com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (20240325.1)

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer MAVEN version 20240325.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer and may be impacted: -...

au.csiro.pathling:fhir-server (>=6.2.2, <=7.2.0), br.com.jarch:jarch-apt (>=20.7.0, <=25.12.0) +773 more potentially affected by CVE-2025-66021 via com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (>=r136, <=20240325.1)

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer MAVEN version =r136, =6.2.2, =20.7.0, =24.2.0, =20.7.0, =23.1.0, =24.2.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.6.8 and more Source cves: CVE-2025-66021 Source advisory:...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=8.0.0, <=8.6.8), ca.uhn.hapi.fhir:hapi-fhir-docs (>=8.0.0, <=8.6.8) +333 more potentially affected by CVE-2025-66021 via com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (20240325.1)

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer MAVEN version 20240325.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer and may be impacted: -...

EUVD-2021-2151

Malware in sbrugna...

owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...

org.internetitem:framework (>=1.9, <=2.1), org.internetitem:logback-elasticsearch-appender (>=1.8, <=2.1) potentially affected by CVE-2011-4457 via com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (r136)

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer MAVEN version r136 is affected by a known vulnerability. The following packages have a transitive dependency on com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer and may be impacted: - org.internetitem:framework...

com.microsoftopentechnologies:azure-slave (>=0.1.0, <=0.3.0), com.microsoftopentechnologies:windows-azure-storage-plugin (0.3.1) +65 more potentially affected by CVE-2011-4457 via com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (r173)

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer MAVEN version r173 is affected by a known vulnerability. The following packages have a transitive dependency on com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer and may be impacted: -...