CVE-2025-29771 HtmlSanitizer vulnerable to XSS when used with contentEditable
Attackers can execute arbitrary scripts via XSS when HtmlSanitizer is used with contentEditable elements due to post-sanitization beautification flaws.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-29771?
CVE-2025-29771 is a medium-severity cross-site scripting vulnerability in jitbit HtmlSanitizer, published on 14 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used with a `contentEditable` element to set the elements `innerHTML` to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. The issue is patched in version 2.0.3.
Weakness: CWE-79
Which versions are affected by CVE-2025-29771?
2 open source packages ship an affected version, including @jitbit/htmlsanitizer.
| Package | Affected | Fixed in |
|---|---|---|
@jitbit/htmlsanitizer npm | All versions | 2.0.3 |
@jitbit/htmlsanitizer npm | All versions | 2.0.3 |
How do I fix CVE-2025-29771?
Upgrade @jitbit/htmlsanitizer to 2.0.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-29771 being exploited?
There is no known exploitation of CVE-2025-29771 in the wild and no public exploit code.
Sources
Also known as GHSA-vhv4-fh94-jm5x.