CVE-2025-66021

Maven/com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer CVE-2025-66021: high

OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

Action: Upgrade com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer to 20260101.1 or later.

Affected

Fixed versions

Sources

• osv: GHSA-g9gq-3pfx-2gw2
• https://github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-g9gq-3pfx-2gw2
• https://nvd.nist.gov/vuln/detail/CVE-2025-66021
• https://github.com/OWASP/java-html-sanitizer/issues/363
• https://github.com/OWASP/java-html-sanitizer/commit/4149cf02ba84db13e8e9d7ee1b01b3f47238e072
• https://github.com/OWASP/java-html-sanitizer/commit/b98cdf1cd5e156a6259b01aa8cdc7372c6efde1e
• https://github.com/OWASP/java-html-sanitizer/commit/d6e0463ed3b48777ecd187913ffdbe767508ff45
• https://github.com/OWASP/java-html-sanitizer

CVE-2025-66021 · published 2025-11-25T22:10:17Z · modified 2026-09-10T03:50:31.015900924Z · JSON