IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-03-14 19:15

MODIFIED

2025-03-14 19:15

EPSS (Prob. Exploit)

0.40%

Top 65.1%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-08

> DESCRIPTION

HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used with a `contentEditable` element to set the elements `innerHTML` to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. The issue is patched in version 2.0.3.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-vhv4-fh94-jm5x MODERATE

JS Html Sanitizer allows XSS when used with contentEditable

AFFECTED PACKAGES:

NPM / @jitbit/htmlsanitizer

< 2.0.3

Fixed in: 2.0.3

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

HtmlSanitizer vulnerable to XSS when used with contentEditable

AFFECTED PACKAGES:

Unknown / Unknown

5 versions affected

ALIASES:

GHSA-vhv4-fh94-jm5x

> HISTORIQUE DES MODIFICATIONS

Première apparition

14/03/2025 19:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:01

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui