https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:58:13 +0000 https://vulnerability.circl.lu/vuln/cve-2021-23980 <p><strong>Affected:</strong> Mozilla Bleach</p> <p>A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.</p> <p><strong>Affected:</strong> Mozilla Bleach</p> <p>A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.</p> https://vulnerability.circl.lu/vuln/cve-2021-23980 https://vulnerability.circl.lu/vuln/ghsa-vv2x-vrpj-qqpq <p><strong>Affected:</strong> PyPI: bleach</p> <p>### Impact</p> <p>A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:</p> <p>* `svg` or `math` in the allowed tags * `p` or `br` in allowed tags * `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags * the keyword argument `strip_comments=False`</p> <p>Note: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.</p> <p>### Patches</p> <p>Users are encouraged to upgrade to bleach v3.3.0 or greater.</p> <p>Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.</p> <p>### Workarounds</p> <p>* modify `bleach.clean` calls to at least one of: * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag * not allow `svg` or `math` tags * not allow `p` or `br` tags * set `strip_comments=True`</p> <p>* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.</p> <p>### References</p> <p>* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399 * https://advisory.checkmarx.net/advisory/CX-2…</p> <p><strong>Affected:</strong> PyPI: bleach</p> <p>### Impact</p> <p>A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:</p> <p>* `svg` or `math` in the allowed tags * `p` or `br` in allowed tags * `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags * the keyword argument `strip_comments=False`</p> <p>Note: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.</p> <p>### Patches</p> <p>Users are encouraged to upgrade to bleach v3.3.0 or greater.</p> <p>Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.</p> <p>### Workarounds</p> <p>* modify `bleach.clean` calls to at least one of: * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag * not allow `svg` or `math` tags * not allow `p` or `br` tags * set `strip_comments=True`</p> <p>* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.</p> <p>### References</p> <p>* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399 * https://advisory.checkmarx.net/advisory/CX-2…</p> https://vulnerability.circl.lu/vuln/ghsa-vv2x-vrpj-qqpq https://vulnerability.circl.lu/vuln/pysec-2021-865 <p><strong>Affected:</strong> PyPI: bleach</p> <p>In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, script, textarea, noframes, iframe, or xmp tags with strip_comments=False.</p> <p><strong>Affected:</strong> PyPI: bleach</p> <p>In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, script, textarea, noframes, iframe, or xmp tags with strip_comments=False.</p> https://vulnerability.circl.lu/vuln/pysec-2021-865