OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N · score source

EPSS

• CVE-2025-66021: 0.29% estimated exploitation activity in the next 30 days; percentile 21.54 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary It is observed that OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. Details The OWASP java HTML sanitizer is vulnerable to XSS. This only happens when HtmlPolicyBuilder allows noscript & style tag with allowTextIn inside style tags. The following condition is very edge case but if users combine a HtmlPolicyBuilder with any other tags except noscript and allow style tag with allowTextIn inside the style tag then In this case sanitizer would be safe from XSS. This happens because how the browser also perceives noscript tags post sanitization. PoC 1. Lets create a HtmlPolicyBuilder which allows p, noscript, style html tags and allows .allowTextIn("style"). 2. There are two XSS payloads which very identical and only difference is one has p…

Published by the source

25 Nov 2025, 22:10 UTC

Last modified by the source

6 Jan 2026, 15:26 UTC

Source last checked

26 Oct 2026, 16:43 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-g9gq-3pfx-2gw2

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2025-66021

Advisory: OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization
IDs: CVE-2025-66021, GHSA-g9gq-3pfx-2gw2
Record: https://patchnext.com/advisories/cve-2025-66021 (revision 1, source checked 26 Oct 2026, 16:43 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer 20260101.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer: affected >= 20240325.1, <= 20240325.1; fixed in 20260101.1

## Suggested inspection (read-only)
- Maven com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-g9gq-3pfx-2gw2 (GitHub-reviewed advisory GHSA-g9gq-3pfx-2gw2 lists affected ranges: Maven com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer >=20240325.1 <=20240325.1)

Commands are suggestions: review each one before running it.