Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes. Bleach applies URI protocol sanitization only to attributes listed in attrvalisuri. While URI-bearing attributes such as action, href, src, and poster are included in that set, formaction is not. As a result, if a downstream application explicitly allows formaction on submit-capable controls in untrusted HTML, Bleach preserves dangerous values such as javascript:alert(1) instead of stripping them. This can lead to submit-triggered JavaScript execution in applications that rely on Bleach to sanitize untrusted HTML and allow the relevant tag/attribute combination. --- Details The issue appears to be a URI-sanitization coverage gap in Bleach’s sanitizer logic. Relevant code paths: bleach/sanitizer.py — BleachSanitizerFilter.allowtoken (around line 553) bleach/vendor/html5lib/filters/sanitizer.py — attrvalisuri (around line 525) In BleachSanitizerFilter.allowtoken, URI protocol…
Recommended action: Upgrade to 6.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A possible XSS bypass affects users calling bleach.clean with all of: a in the allowed tags href in allowed attributes The bleach.clean sanitizer outputs URIs containing disallowed scheme patterns that it should be stripping. However, because the inserted Unicode characters make the scheme invalid per RFC 3986, modern browsers do not execute these as javascript: URIs. The practical security impact is limited to: - Bleach's output contains URI values that violate the caller's protocol allowlist, breaking the sanitizer's contract. - If a downstream system performs its own Unicode normalization on bleach's output (stripping invisible characters before rendering), the javascript: scheme could become valid. This is a non-standard processing chain but represents a theoretical secondary risk. This is not a direct XSS vulnerability. Python code example from reporter with Bleach v6.3.0 and Python 3.13: Output: Patches Users should upgrade to Bleach 6.4.0. Workarounds Pre-process…
Recommended action: Upgrade to 6.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False Note: none of the above tags are in the default allowed tags and stripcomments defaults to True. Patches Users are encouraged to upgrade to bleach v3.3.0 or greater. Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default. Workarounds modify bleach.clean calls to at least one of: not allow the style, title, noscript, script, textarea, noframes, iframe, or xmp tag not allow svg or math tags not allow p or br tags set stripcomments=True A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk. References https://bugzilla.mozilla.org/showbug.cgi?id=1689399 https://advisory.checkmarx.net/advisory/CX-2021-4303…
Recommended action: Upgrade to 3.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). Patches 3.1.4 Workarounds do not whitelist the style attribute in bleach.clean calls limit input string length References https://bugzilla.mozilla.org/showbug.cgi?id=1623633 https://www.regular-expressions.info/redos.html https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817 Credits Reported by schwag09 of r2c For more information If you have any questions or comments about this advisory: Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
Recommended action: Upgrade to 3.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A mutation XSS affects users calling bleach.clean with all of: the svg or math in the allowed/whitelisted tags an RCDATA tag (see below) in the allowed/whitelisted tags the keyword argument strip=False Patches Users are encouraged to upgrade to bleach v3.1.2 or greater. Workarounds modify bleach.clean calls to use strip=True, or not whitelist math or svg tags and one or more of the following tags: A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk. References https://bugzilla.mozilla.org/showbug.cgi?id=1621692 https://cure53.de/fp170.pdf https://nvd.nist.gov/vuln/detail/CVE-2020-6816 https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach Credits Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx For more information If you have any questions or comments about this advisory: Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
Recommended action: Upgrade to 3.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A mutation XSS affects users calling bleach.clean with noscript and a raw tag (see below) in the allowed/whitelisted tags option. Patches v3.1.1 Workarounds modify bleach.clean calls to not whitelist noscript and one or more of the following raw tags: A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk. References https://bugzilla.mozilla.org/showbug.cgi?id=1615315 https://cure53.de/fp170.pdf https://nvd.nist.gov/vuln/detail/CVE-2020-6802 https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach Credits Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx For more information If you have any questions or comments about this advisory: Open an issue at https://github.com/mozilla/bleach/issues Email us at security@mozilla.org
Recommended action: Upgrade to 3.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
Recommended action: Upgrade to 2.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.