Executive brief
Jitbit HtmlSanitizer is a JavaScript library used to clean and validate HTML input in web applications. The library fails to properly sanitize HTML when used with editable content elements, allowing attackers to inject and execute malicious scripts that can steal user data, modify page content, or perform actions on behalf of users.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) in the @jitbit/htmlsanitizer npm package. It occurs when the sanitizer output is applied to a contentEditable element's innerHTML. An attacker can craft malicious HTML that bypasses the sanitization checks by exploiting a code beautifier that runs after sanitization, allowing XSS payload execution. The attack requires no authentication and is reachable over the network via a crafted webpage. The vulnerability was patched in version 2.0.3; all prior versions are affected.
Affected products
- Jitbit HtmlSanitizer < 2.0.3
Timeline
- 2025-03-14: disclosed: GHSA-vhv4-fh94-jm5x published
- 2025-03-14: patched: Fixed in version 2.0.3