CVE-2024-34078High▾ TwilightArbitrary HTML present after sanitization because of unicode normalization
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.6%
Last analysed / modified upstream
If using keep_typographic_whitespace=False (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization.
The problem has been fixed in 2.4.2.
Set keep_typographic_whitespace=True explicitly, or normalize to NFKC yourself earlier.
html-sanitizer < 2.4.2Upgrade to a patched release:
html-sanitizer 2.4.2