An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.

Affected: Ubuntu:Pro:16.04:LTS: python-bleach, Ubuntu:Pro:18.04:LTS: python-bleach, Ubuntu:Pro:20.04:LTS: python-bleach

It was discovered that Bleach did not properly sanitize URI attributes containing character entities. An attacker could possibly use this issue to construct a URI with a disallowed scheme that would bypass sanitization, leading to cross-site scripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-7753)

Yaniv Nizry discovered that Bleach was vulnerable to a mutation cross-site scripting issue when sanitizing HTML with the noscript tag and a raw tag in the allowed tags list. An attacker could possibly use this issue to inject malicious content, leading to cross-site scripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-6802)

Yaniv Nizry discovered that Bleach was vulnerable to a mutation cross-site scripting issue when sanitizing HTML with RCDATA together with svg or math tags in the allowed tags list. An attacker could possibly use this issue to inject malicious content, leading to cross-site scripting. (CVE-2020-6816)

It was discovered that Bleach incorrectly handled parsing of style attributes when sanitizing HTML. An attacker could possibly use this issue to perform a regular expression denial of service, leading to excessive resource consumption. (CVE-2020-6817)

Yaniv Nizry and Michał Bentkowski discovered that Bleach was vulnerable to a mutation cross-site scripting issue when sanitizing HTML with certain combinations of allowed tags. An attacker could possibly use this issue to inject malicious content, leading to cross-site scripting. (CVE-2021-23…