Cross-site scripting in Java HTML Sanitizer - #VU152246
Published: September 25, 2026
Vulnerability identifier: #VU152246
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script.
The vulnerability exists due to failure to apply attribute and URL policies in the stripDisallowedTags function when sanitizing untrusted HTML using policies that allow text in style or script elements. A remote attacker can submit crafted HTML containing allowed elements with dangerous attributes or URLs to execute arbitrary script.
Only custom policies that allow a style or script element and use allowTextIn are affected; prepackaged Sanitizers policies are not affected.
Affected software
Java HTML Sanitizer
Remediation
Install security update from vendor's website.
Java HTML Sanitizer - update to 20260921.1