JS Html Sanitizer allows XSS when used with contentEditable

Description

XSS vulnerability when the sanitizer is used with a contentEditable element to set the elements innerHTML to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation.

Recommendation

Update the @jitbit/htmlsanitizer package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.3
• Patched version(s): 2.0.3

References

• GHSA-vhv4-fh94-jm5x
• CVE-2025-29771
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prebid-universal-creative latest on npm briefly compromised - CVE-2025-59039
• Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags - CVE-2021-33295
• Joplin Vulnerable to Cross-site Scripting in Note Content - CVE-2018-1000534
• zcap has incomplete expiration checks in capability chains. - CVE-2024-31995

Tags:

npm

@jitbit/htmlsanitizer