CVE-2025-29771: HtmlSanitizer XSS Vulnerability

CVE-2025-29771 Overview

CVE-2025-29771 is a cross-site scripting (XSS) vulnerability in jitbit/HtmlSanitizer, a client-side HTML sanitizer library. The flaw affects versions prior to 2.0.3. It triggers when the sanitizer output is written to a contentEditable element via innerHTML. A code beautifier runs after sanitation and can be abused with a crafted payload to reintroduce executable markup. The maintainers patched the issue in version 2.0.3. The weakness is classified as CWE-79.

Critical Impact
Attackers can bypass HTML sanitation and inject script into contentEditable DOM contexts when applications rely on HtmlSanitizer output, enabling client-side script execution in the victim's browser session.

Affected Products

jitbit/HtmlSanitizer versions prior to 2.0.3
Web applications embedding HtmlSanitizer output into contentEditable elements via innerHTML
Client-side rich-text editors and comment/forum components using the affected library

Discovery Timeline

2025-03-14 - CVE-2025-29771 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29771

Vulnerability Analysis

HtmlSanitizer parses untrusted HTML into a DOM tree and produces a sanitized copy of allowed elements and attributes. After sanitation, the library runs a post-processing beautifier that rewrites the serialized innerHTML string using regular expressions. The beautifier applied a regex that inserted a and newline between existing tags and adjacent non-whitespace characters. Because this transformation runs on the already-sanitized string, it can reassemble characters into markup that the sanitizer would otherwise have removed. When the caller assigns the result to a contentEditable element's innerHTML, the browser re-parses the string and executes the newly formed script constructs.

Root Cause

The root cause is post-sanitation string rewriting. Sanitizers must be the last transformation applied to untrusted HTML. HtmlSanitizer violated this principle by running regex-based beautification on the serialized output, allowing crafted input to exploit the rewrite step and bypass earlier tag and attribute filtering.

Attack Vector

Exploitation requires user interaction. An attacker submits crafted HTML that survives HtmlSanitizer's tag and attribute allowlist but manipulates the trailing beautifier regex. When a victim loads the sanitized content into a contentEditable region using innerHTML, the browser interprets the reintroduced markup and executes attacker-controlled script in the origin of the hosting page.

javascript

// Patch from HtmlSanitizer.js - version 2.0.3
// The vulnerable <br> beautification regex was removed

	let resultElement = makeSanitizedCopy(doc.body);

	return resultElement.innerHTML
-		.replace(/<br[^>]*>(\S)/g, "<br>\n$1")
		.replace(/div><div/g, "div>\n<div"); //replace is just for cleaner code

Source: jitbit/HtmlSanitizer commit af6d2a7. The patch removes the -adjacent regex that ran after sanitation, eliminating the post-processing rewrite that attackers abused.

Detection Methods for CVE-2025-29771

Indicators of Compromise

Client-side script execution originating from DOM regions populated by HtmlSanitizer output
Unexpected <script>, event-handler attributes (onerror, onload), or javascript: URIs appearing inside contentEditable elements after sanitation
Content Security Policy (CSP) violation reports referencing inline script execution in editor components
Stored user-supplied HTML containing unusual sequences adjacent to non-whitespace tokens designed to reconstruct markup after regex rewriting

Detection Strategies

Inventory front-end dependencies for jitbit/HtmlSanitizer at versions below 2.0.3 using Software Composition Analysis (SCA) tooling
Review application code for calls that assign HtmlSanitizer output to innerHTML on contentEditable elements
Add browser-side telemetry that alerts when script nodes appear in DOM subtrees seeded from sanitized user content

Monitoring Recommendations

Enable and monitor a strict CSP with report-uri or report-to to capture inline-script violations tied to editor views
Log server-side rejections of stored content that fails a secondary allowlist validation after client sanitation
Track dependency updates for jitbit/HtmlSanitizer in CI/CD and alert on builds that pin versions earlier than 2.0.3

How to Mitigate CVE-2025-29771

Immediate Actions Required

Upgrade jitbit/HtmlSanitizer to version 2.0.3 or later across all front-end bundles
Rebuild and redeploy any application artifacts that ship the vulnerable library, including cached CDN assets
Audit code paths that assign sanitizer output to innerHTML, particularly on contentEditable regions
Re-sanitize or invalidate stored user content that was accepted while the vulnerable version was in production

Patch Information

The fix is included in HtmlSanitizer 2.0.3. See the GitHub Security Advisory GHSA-vhv4-fh94-jm5x and the corrective commit af6d2a7 for full details. The patch removes the post-sanitation beautification regex that enabled the bypass.

Workarounds

Avoid assigning sanitizer output to innerHTML; use textContent or DOM node construction where possible
Apply a server-side HTML sanitation pass with a well-maintained library before rendering content to clients
Deploy a strict Content Security Policy that disallows inline scripts and event handlers to reduce XSS impact
Remove or replace contentEditable regions that render untrusted content until the library is updated

bash

# Upgrade the vulnerable package to the patched release
npm install jitbit-html-sanitizer@2.0.3

# Verify no vulnerable versions remain in the dependency tree
npm ls jitbit-html-sanitizer