---
id: CVE-2024-34078
aliases:
  - GHSA-wvhx-q427-fgh3
  - PYSEC-2026-1455
title: Arbitrary HTML present after sanitization because of unicode normalization
summary: Arbitrary HTML present after sanitization because of unicode normalization
severity: high
vendor: html-sanitizer
product: html-sanitizer
ecosystem: pip
affected:
  - html-sanitizer < 2.4.2
patched:
  - html-sanitizer 2.4.2
published: '2024-05-06'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:14.569601746Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wvhx-q427-fgh3'
references:
  - url: >-
      https://github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3
  - url: >-
      https://github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550
  - url: 'https://github.com/matthiask/html-sanitizer'
tags:
  - osv
  - pip
epss: 0.00551
epssPercentile: 0.43624
ingestedAt: '2026-07-08T18:25:53.911Z'
---

## Overview

### Impact

If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization.

### Patches

The problem has been fixed in 2.4.2.

### Workarounds

Set `keep_typographic_whitespace=True` explicitly, or normalize to NFKC yourself earlier.


## Affected packages

- `html-sanitizer < 2.4.2`

## Remediation

Upgrade to a patched release:

- `html-sanitizer 2.4.2`