# com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven) vulnerabilities

3 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 20261107.1 (Nov 8, 2026): no advisory with comparable ranges affects it; 2 advisories (CVE-2021-42575, CVE-2011-4457) can't be checked against versions
- Newest unaffected release: 20261107.1 (Nov 8, 2026), the latest release, not counting 2 advisories without comparable ranges
- Releases: 43 since 1.1 (Oct 8, 2015)
- Registry: https://central.sonatype.com/artifact/com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2025-66021: 20240325.1 (20260101.1 is outside it)
- CVE-2021-42575: its ranges can't be placed on these versions
- CVE-2011-4457: its ranges can't be placed on these versions

## Advisories (3)

### [CVE-2025-66021](https://cve.now/CVE-2025-66021): OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

- Severity: High 8.6
- Published: Nov 26, 2025
- Affected: from 20240325.1, fixed in 20260101.1.
- Fixed in 20260101.1 (released Jan 1, 2026, 36 days after disclosure).
- The latest release, 20261107.1, is not affected.

### [CVE-2021-42575](https://cve.now/CVE-2021-42575): The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

- Severity: Unrated
- Published: Oct 18, 2021
- Affected: fixed in 20211018.1.

### [CVE-2011-4457](https://cve.now/CVE-2011-4457): OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to…

- Severity: Unrated
- Published: Nov 17, 2011
- Affected: fixed in 88.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.