Detections
Analytics

SCA: security update for com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (GHSA-g9gq-3pfx-2gw2)

high Tenable Cloud Security Plugin ID 436599

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML
 authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP
 java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with
 allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it
 does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no
 known patch is available. (CVE-2025-66021)

See Also

https://github.com/advisories/GHSA-g9gq-3pfx-2gw2

Plugin Details

Severity: High

ID: 436599

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/6/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2025-66021

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.6

Threat Score: 7.3

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/25/2025

Vulnerability Publication Date: 11/25/2025

Reference Information

CVE: CVE-2025-66021

cwe: CWE-79