CVE-2025-66021
Reported by github_m · Published November 26, 2025
owasp-java-html-sanitizer is fixed in 20260101.1 and 20240325.1 (Maven Central)
OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer | Maven Central | 20260101.1, 20240325.1 |
| keycloak-26.4 | Wolfi | 26.4.7-r3 |
| keycloak-26.4 | Chainguard | 26.4.7-r3 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| OWASP | java-html-sanitizer | = 20240325.1 |
| Maven | com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer | 20240325.1, 20240325.1 |
| wolfi | keycloak-26.4 | 0 |
| chainguard | keycloak-26.4 | 0 |
| OWASP | java-html-sanitizer | 20240325.1 |
| chainguard | keycloak-26.3 | 0 |
Timeline
- Nov 25, 2025 CVE Published
- Nov 26, 2025 EPSS Score (30 in total, the first dated here)
- Feb 20, 2026 PoC Published
- Mar 17, 2026 Security Advisory
- Mar 17, 2026 CVE Updated
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-66021
vulnetix vdb fixes CVE-2025-66021Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-66021/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/OWASP/java-html-sanitizer/security/advisories/GHSA-g9gq-3pfx-2gw2 x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2025-66021 advisory
- https://github.com/advisories/GHSA-g9gq-3pfx-2gw2 advisory
- https://github.com/OWASP/java-html-sanitizer/issues/363 url
- https://github.com/OWASP/java-html-sanitizer/commit/4149cf02ba84db13e8e9d7ee1b01b3f47238e072 patch
- https://github.com/OWASP/java-html-sanitizer/commit/b98cdf1cd5e156a6259b01aa8cdc7372c6efde1e patch
- https://github.com/OWASP/java-html-sanitizer/commit/d6e0463ed3b48777ecd187913ffdbe767508ff45 patch
- https://github.com/OWASP/java-html-sanitizer url