PT-2025-26646 · Unknown · Htmlsanitizer.Jl

Pfitzseb · Published 2025-06-23 · Updated 2025-10-14 · CVE-2025-52561

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: HTMLSanitizer.jl versions prior to 0.2.1

Description: The issue is related to improper HTML sanitization in HTMLSanitizer.jl, a Whitelist-based HTML sanitizer. When the style tag is added to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML. This enables tag injection and JavaScript execution, potentially resulting in cross-site scripting (XSS) in any HTML sanitized with this library.

Recommendations: For versions prior to 0.2.1, update to version 0.2.1 to resolve the issue. As a temporary workaround, consider adding the math and svg elements to the whitelist manually.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-52561

GHSA-3MJ7-QXH9-6Q4P

JLSEC-2025-39

Affected Products

Htmlsanitizer.Jl

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52561.json · Exploit
• https://osv.dev/vulnerability/JLSEC-2025-39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52561 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52561 · Security Note
• https://github.com/JuliaComputing/HTMLSanitizer.jl/commit/0c3dc359e4a64c39cac609541945c0518feef040 · Note
• https://github.com/JuliaComputing/HTMLSanitizer.jl/security/advisories/GHSA-3mj7-qxh9-6q4p · Note
• https://github.com/JuliaComputing/HTMLSanitizer.jl/pull/5 · Note
• https://twitter.com/transilienceai/status/1937355235271541048 · Twitter Post
• https://twitter.com/CVEnew/status/1937258255299858541 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1937296635672895831 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1lk1p4q/top_10_trending_cves_25062025 · Reddit Post
• https://twitter.com/transilienceai/status/1937355225213600030 · Twitter Post
• https://twitter.com/transilienceai/status/1937355234399199732 · Twitter Post
• https://t.me/cvetracker/26876 · Telegram Post