HTMLSanitizer.jl Vulnerability Allows Tag Injection in Julia Library

CVE-2025-52561

What is CVE-2025-52561?

The HTMLSanitizer.jl library, a whitelist-based HTML sanitizer for Julia, has a vulnerability that arises when the style tag is added to the whitelist. In versions prior to 0.2.1, the content inside the style tag is mistakenly unescaped, allowing for the injection of content that includes closing tags. As a consequence, attackers could execute arbitrary JavaScript through tag injection during sanitation processes. This vulnerability poses a significant risk for applications utilizing this library for HTML sanitization, as it can lead to cross-site scripting attacks. The issue has been resolved in version 0.2.1, and users are advised to manually whitelist additional elements such as math and svg to mitigate risks.

References