OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization
Date: 2025-11
Affected: maven/com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-66021
CWE: CWE-79

### Summary It is observed that OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows `noscript` and `style` tags with `allowTextIn` inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. ### Details The OWASP java HTML sanitizer is vulnerable to XSS. This only happens when HtmlPolicyBuilder allows `noscript` & `style` tag with `allowTextIn` inside style tags. The following condition is very edge case but if users combine a HtmlPolicyBuilder with any other tags except `noscript` and allow `style` tag with `allowTextIn` inside the style tag then In this case sanitizer would be safe from XSS. This happens because how the browser also perceives `noscript` tags post sanitization. ### PoC 1. Lets create a `HtmlPolicyBuilder` which allows `p, noscript, style` html tags and allows `.allowTextIn("style")`. 2. There are two XSS payloads which very identical and only difference is one has p tag and other has noscript tag. These payload have script tags that could be vulnerable to XSS and should be stripped out after sanitisation. ```HTML 1. <noscript><style></noscript><script>alert(1)</script> 2. <p><style></p><script>alert(1)</script> ``` 3. Run the following piece of code which sanitizes the payload. ```java public class main { private static final String ALLOWED_HTML_TAGS = "p, noscript, style"; /** * Description of vulnerabili


Mitigations:

Architectural layers (MAESTRO):