PT-2025-48110 · Owasp+1 · Owasp Java Html Sanitizer+1

Ironfisto · Published 2025-11-25 · Updated 2026-02-17 · CVE-2025-66021

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OWASP Java HTML Sanitizer versions 20240325.1

Description OWASP Java HTML Sanitizer is vulnerable to Cross-Site Scripting (XSS) when the HtmlPolicyBuilder allows noscript and style tags with allowTextIn enabled within the style tag. This occurs because the sanitizer does not properly sanitize CSS when these conditions are met, potentially allowing malicious scripts to execute. The issue arises when the browser interprets the combination of noscript and style tags in a way that bypasses sanitization, leading to XSS. The vulnerability is triggered when a crafted payload containing script tags within the allowed tags is processed. The issue is edge case and only happens when HtmlPolicyBuilder allows noscript & style tag with allowTextIn inside style tags.

Recommendations Update to a newer version that contains a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66021

ECHO-51B1-DA5D-175B

GHSA-G9GQ-3PFX-2GW2

Affected Products

Bamboo

Owasp Java Html Sanitizer

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66021.json · Exploit
• 🔥 https://github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-g9gq-3pfx-2gw2 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66021 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66021 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66021 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g9gq-3pfx-2gw2 · Vendor Advisory
• https://github.com/OWASP/java-html-sanitizer/commit/b98cdf1cd5e156a6259b01aa8cdc7372c6efde1e · Note
• https://github.com/OWASP/java-html-sanitizer/issues/363 · Note
• https://github.com/OWASP/java-html-sanitizer/commit/d6e0463ed3b48777ecd187913ffdbe767508ff45 · Note
• https://github.com/OWASP/java-html-sanitizer/commit/4149cf02ba84db13e8e9d7ee1b01b3f47238e072 · Note
• https://github.com/OWASP/java-html-sanitizer · Note
• https://reddit.com/r/VulnMatter/comments/1pbe9h1/resumen_diario_de_vulnerabilidades_01122025 · Reddit Post
• https://jira.atlassian.com/browse/BAM-26309 · Note
• https://reddit.com/r/VulnMatter/comments/1p9dokj/resumen_diario_de_vulnerabilidades_29112025 · Reddit Post
• https://t.me/CVEtracker/38262 · Telegram Post