CVE-2020-6817High· 7.5▾ Twilightregular expression denial-of-service (ReDoS) in Bleach
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.7%
0.7% → 0.7%
bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
3.1.4
do not whitelist the style attribute in bleach.clean calls
limit input string length
If you have any questions or comments about this advisory:
bleach < 3.1.4Upgrade to a patched release:
bleach 3.1.4Connected by shared product, vendor, weakness, or advisory.
CVE-2021-23980Medium· 6.1Cross-site scripting in Bleach
CVE-2020-6802Medium· 6.1XSS in Bleach when noscript and raw tag whitelisted
CVE-2020-6816Medium· 6.1Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag
GHSA-8rfp-98v4-mmr6Low· 0.0Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output
GHSA-gj48-438w-jh9vMedium· 6.1Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
GHSA-g75f-g53v-794xMedium· 4.3Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning