8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66021

CVE-2025-66021: OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66021

CVE-2025-66021:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer	maven	= 20240325.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Scripting (XSS) issue in the OWASP Java HTML Sanitizer, identified as GHSA-g9gq-3pfx-2gw2. It arises from the improper handling of HTML content when a specific, non-default policy is configured. The exploit requires the policy to permit both <noscript> and <style> tags, and critically, to allow text content within <style> elements using the .allowTextIn("style") method.

The core of the problem is a flaw in the sanitizer's parsing logic. When it encounters a malicious string like <noscript><style></noscript><script>alert(1)</script>, it incorrectly processes the </noscript> tag as a valid tag closure, even though it's inside a <style> block that should be treated as text. This results in a sanitized output that, when rendered by a browser, allows a <script> tag to be executed outside the intended sanitized context. The browser's unique parsing rules for <noscript> content contribute to the successful execution of the script.

The primary vulnerable function is org.owasp.html.PolicyFactory.sanitize, as this is the method that performs the flawed sanitization. The org.owasp.html.HtmlPolicyBuilder.allowTextIn method is also identified as a key function, as it enables the specific configuration that exposes the vulnerability. An engineer with this CVE in their environment should be aware that any use of the sanitizer with this particular combination of policy rules is at risk and should be remediated by avoiding this configuration until a patch is available.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.