Executive brief
In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.
Affected products
- PyPI bleach
Junglewise Threat Intelligence
CVE-2020-6816: PYSEC-2020-28 - In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argume
CVE-2020-6816 · Severity: low · CVSS 3.1 · Published 2020-03-24
Technologies: bleach (PyPI). Vendors: PyPI.
Related threats
- Mozilla Bleach XSS via unsanitized formaction attribute
- Mozilla Bleach ReDoS in linkify with parse_email enabled
- Mozilla Bleach URI sanitization bypass via Unicode characters
- PYSEC-2021-865 - In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, scr
- PYSEC-2020-340 - In Mozilla Bleach before 3.1.4, `bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReD