Medium severity · published Nov 26, 2025
CVE-2025-66021
OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
java-html-sanitizer · OWASP
= 20240325.1 · source: vendor
JH
Java Html Sanitizer · Owasp
20240325.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66021
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66021
Exploit
https://github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-g9gq-3pfx-2gw2
More from java-html-sanitizer
9.8
CVE-2021-42575
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements