JS Html Sanitizer allows XSS when used with contentEditable
Date: 2025-03
Affected: npm/@jitbit/htmlsanitizer
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-29771
CWE: CWE-79

### Impact XSS vulnerability when the sanitizer is used with a `contentEditable` element to set the elements `innerHTML` to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. ### Patches Patched in version 2.0.3


Mitigations:

Architectural layers (MAESTRO):