---
id: CVE-2021-23980
aliases:
  - GHSA-vv2x-vrpj-qqpq
  - PYSEC-2021-865
title: Cross-site scripting in Bleach
summary: Cross-site scripting in Bleach
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: bleach
product: bleach
ecosystem: pip
affected:
  - bleach < 3.3.0
patched:
  - bleach 3.3.0
published: '2021-02-02'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vv2x-vrpj-qqpq'
references:
  - url: 'https://github.com/mozilla/bleach/security/advisories/GHSA-vv2x-vrpj-qqpq'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-23980'
  - url: >-
      https://github.com/mozilla/bleach/commit/79b7a3c5e56a09d1d323a5006afa59b56162eb13
  - url: 'https://advisory.checkmarx.net/advisory/CX-2021-4303'
  - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=1689399'
  - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-23980'
  - url: 'https://cure53.de/fp170.pdf'
  - url: 'https://github.com/mozilla/bleach'
  - url: >-
      https://github.com/mozilla/bleach/blob/79b7a3c5e56a09d1d323a5006afa59b56162eb13/CHANGES#L4
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2021-865.yaml
  - url: 'https://pypi.org/project/bleach'
tags:
  - osv
  - pip
epss: 0.00483
epssPercentile: 0.40743
ingestedAt: '2026-07-08T18:25:53.476Z'
---

## Overview

### Impact                                                                                                                                                                                                                                                    

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

* `svg` or `math` in the allowed tags
* `p` or `br` in allowed tags
* `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags
* the keyword argument `strip_comments=False`

Note: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.

### Patches

Users are encouraged to upgrade to bleach v3.3.0 or greater.

Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.

### Workarounds

* modify `bleach.clean` calls to at least one of:
  * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag
  * not allow `svg` or `math` tags
  * not allow `p` or `br` tags
  * set `strip_comments=True`

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399
* https://advisory.checkmarx.net/advisory/CX-2021-4303
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980
* https://cure53.de/fp170.pdf

### Credits

* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx
* Additional eject tags not mentioned in the original advisory and the CSP mitigation line being truncated in the revised advisory reported by [Michał Bentkowski](https://twitter.com/SecurityMB) at Securitum

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)
* Email us at [security@mozilla.org](mailto:security@mozilla.org)

## Affected packages

- `bleach < 3.3.0`

## Remediation

Upgrade to a patched release:

- `bleach 3.3.0`