Medium severityOSV Advisory· Published Mar 14, 2025· Updated Apr 15, 2026
CVE-2025-29771
CVE-2025-29771
Description
HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used with a contentEditable element to set the elements innerHTML to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. The issue is patched in version 2.0.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@jitbit/htmlsanitizernpm | < 2.0.3 | 2.0.3 |
Affected products
2- Range: 1.0.0, 1.0.1, 2.0.0, …
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.