CVE-2025-29771CWE-79

HtmlSanitizer vulnerable to XSS when used with contentEditable

Medium · published March 14, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used with a `contentEditable` element to set the elements `innerHTML` to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. The issue is patched in version 2.0.3.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00404 · 33.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-03-14T18:56Z
EPSS history
Timeline
  • 14 MAR 18:56Z
    HtmlSanitizer vulnerable to XSS when used with contentEditable
    cvelistv5