PT-2025-11301 · Unknown · Sanitize-Html

Published 2025-03-14 · Updated 2025-03-14 · CVE-2025-29771

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: HtmlSanitizer versions prior to 2.0.3

Description: The issue is a cross-site scripting vulnerability that occurs when HtmlSanitizer is used with a contentEditable element to set the element's innerHTML to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier that runs after sanitation, it can lead to exploitation.

Recommendations: For versions prior to 2.0.3, update to version 2.0.3 to resolve the issue. As a temporary workaround, consider disabling the use of contentEditable elements with HtmlSanitizer until the update is applied. Restrict access to the code beautifier function to minimize the risk of exploitation. Avoid using the innerHTML property to set sanitized strings produced by HtmlSanitizer in contentEditable elements until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-29771

GHSA-VHV4-FH94-JM5X

Affected Products

Sanitize-Html

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29771.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29771 · Security Note
• https://osv.dev/vulnerability/GHSA-vhv4-fh94-jm5x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29771 · Vendor Advisory
• https://github.com/jitbit/HtmlSanitizer/security/advisories/GHSA-vhv4-fh94-jm5x · Note
• https://github.com/jitbit/HtmlSanitizer/commit/af6d2a78877e7277cd01c825b7fb50edb5956963 · Note
• https://github.com/jitbit/HtmlSanitizer · Note
• https://t.me/cvedetector/20328 · Telegram Post
• https://twitter.com/CVEnew/status/1900626159500406935 · Twitter Post
• https://t.me/cvetracker/19156 · Telegram Post