XSS Vulnerability in OWASP Java HTML Sanitizer

CVE-2025-66021

What is CVE-2025-66021?

The OWASP Java HTML Sanitizer, a customizable HTML processor, is susceptible to Cross-Site Scripting (XSS) attacks when certain HTML policy configurations permit the use of 'noscript' and 'style' tags. Specifically, if the HtmlPolicyBuilder allows unfiltered CSS within styled content, attackers could exploit this vulnerability by injecting malicious payloads that evade sanitization. This presents a significant security risk for web applications that rely on user-generated content. As of the latest available information, no patches have been released to rectify this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References