~ / search / GHSA-vhv4-fh94-jm5x

GHSA-vhv4-fh94-jm5x

JS Html Sanitizer allows XSS when used with contentEditable

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-29771

Packages

EcosystemPackageAffectedFixed in
npm @jitbit/htmlsanitizer < 2.0.3 2.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact XSS vulnerability when the sanitizer is used with a `contentEditable` element to set the elements `innerHTML` to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. ### Patches Patched in version 2.0.3

References

External links from the advisory. They lead to third-party sites.