Vulnerability · Published Jun 23, 2025 · Assigned by GitHub_M

CVE-2025-52561HTMLSanitizer.jl Possible XSS

Medium 6.9

In plain English

A medium-severity cross-site scripting in HTMLSanitizer.jl from JuliaComputing. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.9%top 41.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This could result in possible cross-site scripting (XSS) in any HTML that is sanitized with this library. This issue has been patched in version 0.2.1. A workaround involves adding the math and svg elements to the whitelist manually.

Affected products (as reported)

Vendor	Product	Versions
JuliaComputing	HTMLSanitizer.jl	< 0.2.1

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References

https://github.com/JuliaComputing/HTMLSanitizer.jl/security/advisories/GHSA-3mj7-qxh9-6q4p x_refsource_CONFIRM
https://github.com/JuliaComputing/HTMLSanitizer.jl/pull/5 x_refsource_MISC
https://github.com/JuliaComputing/HTMLSanitizer.jl/commit/0c3dc359e4a64c39cac609541945c0518feef040 x_refsource_MISC