CVE-2025-66021 OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization
Attackers can execute arbitrary scripts via crafted noscript and style tags in applications using OWASP Java HTML Sanitizer with specific policies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-66021?
CVE-2025-66021 is a high-severity cross-site scripting vulnerability in OWASP java-html-sanitizer, published on 26 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.
Weakness: CWE-79
Which versions are affected by CVE-2025-66021?
2 open source packages ship an affected version, including com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer Maven | From 20240325.1 | 20260101.1 |
com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer Maven | From 20240325.1 | 20260101.1 |
Products include Owasp Java Html Sanitizer.
How do I fix CVE-2025-66021?
Upgrade com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer to 20260101.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-66021 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66021 exists.
Sources
Also known as CLEANSTART-2026-JC10093, CLEANSTART-2026-JX60561, CLEANSTART-2026-PZ98316, GHSA-g9gq-3pfx-2gw2, MINI-2pm5-wrpf-cjh5, MINI-vjr4-cp2p-4h46 and 1 more.