Skip to content
Patch Next
Sign inAdd to your agent

← Actionable
Medium, CVSS 5.3amended

Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag

CVE-2020-6816GHSA-m6xf-fq7q-8743

What to do

Vendor fix available. Upgrade each affected package to the fixed version on its release line (bleach 3.1.2), redeploy, then verify what is actually installed.

This page has no inventory attached, so it cannot say whether you are affected. A vendor fix is not proof that your deployment is fixed.

Add to your agent

Affected packages

  • PyPI bleach

    Affected
    < 3.1.2
    Fixed in
    3.1.2

Sources

Severity and exploitation
Exploitation
No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.
CVSS 4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N · score source
EPSS
  • CVE-2020-6816: 1.34% estimated exploitation activity in the next 30 days; percentile 71.34 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.
Source description

As published by the source; long descriptions are shortened.

Impact A mutation XSS affects users calling bleach.clean with all of: the svg or math in the allowed/whitelisted tags an RCDATA tag (see below) in the allowed/whitelisted tags the keyword argument strip=False Patches Users are encouraged to upgrade to bleach v3.1.2 or greater. Workarounds modify bleach.clean calls to use strip=True, or not whitelist math or svg tags and one or more of the following tags: A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk. References https://bugzilla.mozilla.org/showbug.cgi?id=1621692 https://cure53.de/fp170.pdf https://nvd.nist.gov/vuln/detail/CVE-2020-6816 https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach Credits Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx For more information If you have any questions or comments about this advisory: Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org

Dates and revisions
Published by the source
Last modified by the source
Source last checked
  1. Revision 3 · amended ·

    Amended from ghsa record GHSA-m6xf-fq7q-8743

  2. Revision 2 · amended ·

    Reviewed OSV alias/range/CVSS4 correction; package source scopes and original publication preserved. No customer finding resolved.

  3. Revision 1 · created ·

    Published from osv record GHSA-m6xf-fq7q-8743

Agent brief

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2020-6816

Advisory: Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag
IDs: CVE-2020-6816, GHSA-m6xf-fq7q-8743
Record: https://patchnext.com/advisories/cve-2020-6816 (revision 3, source checked 26 Oct 2026, 13:16 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: bleach 3.1.2. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI bleach: affected < 3.1.2; fixed in 3.1.2

## Suggested inspection (read-only)
- `python -m pip show bleach`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on bleach.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-m6xf-fq7q-8743 (OSV record GHSA-m6xf-fq7q-8743 lists affected ranges: PyPI bleach >=0 <3.1.2 (fixed))
- Verified: https://github.com/advisories/GHSA-m6xf-fq7q-8743 (GitHub-reviewed advisory GHSA-m6xf-fq7q-8743 lists affected ranges: PyPI bleach >=0 <3.1.2)

Commands are suggestions: review each one before running it.

Loading voting…