XSS in Jitbit Htmlsanitizer
CVE-2025-29771
HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used with a `contentEditable` element to set the elements `innerHTML` to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. The issue is patched in version 2.0.3.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (30.0th percentile) — read the EPSS interpretation.
Affected products
- Jitbit Htmlsanitizer — versions < 2.0.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)