{"id":"CVE-2024-34078","aliases":["GHSA-wvhx-q427-fgh3","PYSEC-2026-1455"],"title":"Arbitrary HTML present after sanitization because of unicode normalization","summary":"Arbitrary HTML present after sanitization because of unicode normalization","severity":"high","vendor":"html-sanitizer","product":"html-sanitizer","ecosystem":"pip","affected":["html-sanitizer < 2.4.2"],"patched":["html-sanitizer 2.4.2"],"published":"2024-05-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:14.569601746Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wvhx-q427-fgh3","references":[{"url":"https://github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3"},{"url":"https://github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550"},{"url":"https://github.com/matthiask/html-sanitizer"}],"tags":["osv","pip"],"epss":0.00551,"epssPercentile":0.4493,"ingestedAt":"2026-07-08T18:25:53.911Z","slug":"CVE-2024-34078","body":"## Overview\n\n### Impact\n\nIf using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization.\n\n### Patches\n\nThe problem has been fixed in 2.4.2.\n\n### Workarounds\n\nSet `keep_typographic_whitespace=True` explicitly, or normalize to NFKC yourself earlier.\n\n\n## Affected packages\n\n- `html-sanitizer < 2.4.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `html-sanitizer 2.4.2`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}