Description
XSS vulnerability when the sanitizer is used with a contentEditable element to set the elements innerHTML to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation.
Recommendation
Update the @jitbit/htmlsanitizer package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.3
- Patched version(s): 2.0.3
References
Could your website be exposed too?
SmartScanner can check your website for JS Html Sanitizer allows XSS when used with contentEditable and gives you actionable findings to investigate.
Start a free scanRelated Issues
- MathLive's Lack of Escaping of HTML allows for XSS - CVE-2025-29049
- Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS) - CVE-2025-27109
- CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS - CVE-2026-26028
- Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101
You might also like:
See something that needs correcting? Let us knowUpdated March 14, 2025