# CVE-2025-66021: OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

Source: https://junglewise.ai/threats/cve-2025-66021-owasp-java-html-sanitizer-is-vulnerable-to-xss-via-noscript-tag  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-26  
License: CC BY 4.0 with a link back

CVE-2025-66021 · Severity: medium · CVSS 6.1 · Published 2025-11-26

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1,  OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.

Technologies: [com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven)](https://junglewise.ai/threats/technologies/com-googlecode-owasp-java-html-sanitizer-owasp-java-html-sanitizer). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [OWASP](https://junglewise.ai/threats/vendors/owasp).

## Quick answers

**Is CVE-2025-66021 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66021 being exploited in the wild.

**How severe is CVE-2025-66021?** Medium severity, with a CVSS score of 6.1, published 26 November 2025.

**Which products and versions are affected?** com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven) ECOSYSTEM:introduced=20240325.1,fixed=20260101.1.

**Is there a fix for CVE-2025-66021?** Yes. com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven): upgrade to 20260101.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-66021?** Check whether you run com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven) or OWASP Java Html Sanitizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven): upgrade to 20260101.1 or later

  ```sh
  # set com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer to 20260101.1 in your pom.xml or build.gradle
  ```


## Affected products

- com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven) ECOSYSTEM:introduced=20240325.1,fixed=20260101.1
- OWASP Java Html Sanitizer

## Identifiers

- CVE-2025-66021
- GHSA-g9gq-3pfx-2gw2

## Related threats

- [OWASP HTML Sanitizer allows redirecting to an arbitrary URL when JavaScript is disabled](https://junglewise.ai/threats/cve-2011-4457-owasp-html-sanitizer-allows-redirecting-to-an-arbitrary-url-when)
- [Policies not properly enforced in OWASP Java HTML Sanitizer](https://junglewise.ai/threats/cve-2021-42575-policies-not-properly-enforced-in-owasp-java-html-sanitizer)