bleach has 7 CVEs on record between 2020 and 2026. The busiest recent month was June 2026 with 3. The median CVSS is 6.1 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 3
Weakness classes
Products
- bleach 7
Worst active — by depth score
CVE-2020-6817High· 7.5regular expression denial-of-service (ReDoS) in Bleach41GHSA-gj48-438w-jh9vMedium· 6.1Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes34CVE-2021-23980Medium· 6.1Cross-site scripting in Bleach34CVE-2020-6816Medium· 6.1Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag34CVE-2020-6802Medium· 6.1XSS in Bleach when noscript and raw tag whitelisted34
bleach vulnerabilities
CVEs affecting bleach, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
GHSA-8rfp-98v4-mmr6Low· 0.0Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output
Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output
GHSA-g75f-g53v-794xMedium· 4.3Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning
Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning
GHSA-gj48-438w-jh9vMedium· 6.1Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
CVE-2021-23980Medium· 6.1Cross-site scripting in Bleach
Cross-site scripting in Bleach
CVE-2020-6817High· 7.5regular expression denial-of-service (ReDoS) in Bleach
regular expression denial-of-service (ReDoS) in Bleach
CVE-2020-6816Medium· 6.1Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag
Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag
CVE-2020-6802Medium· 6.1XSS in Bleach when noscript and raw tag whitelisted
XSS in Bleach when noscript and raw tag whitelisted