GitHub Advisoryadvisory · npm

GHSA-vhv4-fh94-jm5x JS Html Sanitizer allows XSS when used with contentEditable

MEDIUM Published 2025-03-14 Modified 2025-03-14 Official page ↗
Aliases
CVE-2025-29771
Ecosystem
npm
Packages
@jitbit/htmlsanitizer
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-03-14

Affected packages

• npm @jitbit/htmlsanitizer: < 2.0.3 → fixed in 2.0.3

Description

Impact XSS vulnerability when the sanitizer is used with a `contentEditable` element to set the elements `innerHTML` to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. Patches Patched in version 2.0.3

Related

Alias · CVE (1)

  • CVE-2025-29771 HtmlSanitizer is a client-side HTML Sanitizer. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References