CVE-2021-23980Medium· 6.1▾ SunlitCross-site scripting in Bleach
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
A mutation XSS affects users calling bleach.clean with all of:
svg or math in the allowed tagsp or br in allowed tagsstyle, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tagsstrip_comments=FalseNote: none of the above tags are in the default allowed tags and strip_comments defaults to True.
Users are encouraged to upgrade to bleach v3.3.0 or greater.
Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.
modify bleach.clean calls to at least one of:
style, title, noscript, script, textarea, noframes, iframe, or xmp tagsvg or math tagsp or br tagsstrip_comments=TrueA strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.
If you have any questions or comments about this advisory:
bleach < 3.3.0Upgrade to a patched release:
bleach 3.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2020-6802Medium· 6.1XSS in Bleach when noscript and raw tag whitelisted
CVE-2020-6817High· 7.5regular expression denial-of-service (ReDoS) in Bleach
CVE-2020-6816Medium· 6.1Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag
GHSA-8rfp-98v4-mmr6Low· 0.0Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output
GHSA-gj48-438w-jh9vMedium· 6.1Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
GHSA-g75f-g53v-794xMedium· 4.3Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning