# CVE-2025-29771: Jitbit HtmlSanitizer XSS in contentEditable handling

Source: https://junglewise.ai/threats/cve-2025-29771-jitbit-htmlsanitizer-xss-in-contenteditable-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-03-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-29771 · Severity: medium · CVSS 4 · Published 2025-03-14

Jitbit HtmlSanitizer is a JavaScript library used to clean and validate HTML input in web applications. The library fails to properly sanitize HTML when used with editable content elements, allowing attackers to inject and execute malicious scripts that can steal user data, modify page content, or perform actions on behalf of users.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-29771 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-29771 being exploited in the wild.

**How severe is CVE-2025-29771?** Medium severity, with a CVSS score of 4, published 14 March 2025.

**Which products and versions are affected?** @jitbit/htmlsanitizer (npm) SEMVER:introduced=0,fixed=2.0.3.

**Is there a fix for CVE-2025-29771?** Yes. @jitbit/htmlsanitizer (npm): upgrade to 2.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-29771 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-29771?** Check whether you run @jitbit/htmlsanitizer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @jitbit/htmlsanitizer (npm): upgrade to 2.0.3 or later

  ```sh
  npm install @jitbit/htmlsanitizer@2.0.3
  ```


## Technical details

The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) in the @jitbit/htmlsanitizer npm package. It occurs when the sanitizer output is applied to a contentEditable element's innerHTML. An attacker can craft malicious HTML that bypasses the sanitization checks by exploiting a code beautifier that runs after sanitization, allowing XSS payload execution. The attack requires no authentication and is reachable over the network via a crafted webpage. The vulnerability was patched in version 2.0.3; all prior versions are affected.

## Affected products

- Jitbit HtmlSanitizer < 2.0.3

## Identifiers

- CVE-2025-29771
- GHSA-vhv4-fh94-jm5x

## Timeline

- 2025-03-14: disclosed: GHSA-vhv4-fh94-jm5x published
- 2025-03-14: patched: Fixed in version 2.0.3

## References

- [https://github.com/jitbit/HtmlSanitizer/security/advisories/GHSA-vhv4-fh94-jm5x](https://github.com/jitbit/HtmlSanitizer/security/advisories/GHSA-vhv4-fh94-jm5x)