Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer

3 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
20261107.1 (Nov 8, 2026): no advisory with comparable ranges affects it; 2 advisories (CVE-2021-42575, CVE-2011-4457) can't be checked against versions
Newest unaffected release
20261107.1 (Nov 8, 2026), the latest release, not counting 2 advisories without comparable ranges
Advisories
3 · 1 high
Releases
43 since 1.1 (Oct 8, 2015)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-66021
    Affects 20240325.1 (20260101.1 is outside it)
  • CVE-2021-42575
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2011-4457
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

    Affected: from 20240325.1, fixed in 20260101.1.

    Fixed in 20260101.1 (released Jan 1, 2026, 36 days after disclosure).

    The latest release, 20261107.1, is not affected.

  • The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

    Affected: fixed in 20211018.1.

  • OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to…

    Affected: fixed in 88.