CVE-2020-6816Medium· 6.1▾ SunlitBleach vulnerable to mutation XSS via whitelisted math or svg and raw tag
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.3%
1.3% → 1.3%
A mutation XSS affects users calling bleach.clean with all of:
svg or math in the allowed/whitelisted tagsstrip=FalseUsers are encouraged to upgrade to bleach v3.1.2 or greater.
bleach.clean calls to use strip=True, or not whitelist math or svg tags and one or more of the following tags:script
noscript
style
noframes
xmp
noembed
iframe
unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.If you have any questions or comments about this advisory:
bleach < 3.1.2Upgrade to a patched release:
bleach 3.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2020-6802Medium· 6.1XSS in Bleach when noscript and raw tag whitelisted
CVE-2020-6817High· 7.5regular expression denial-of-service (ReDoS) in Bleach
CVE-2021-23980Medium· 6.1Cross-site scripting in Bleach
GHSA-8rfp-98v4-mmr6Low· 0.0Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output
GHSA-gj48-438w-jh9vMedium· 6.1Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
GHSA-g75f-g53v-794xMedium· 4.3Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning