CVE-2021-23980: PYSEC-2021-865 - In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, scr

CVE-2021-23980 · Severity: low · CVSS 3.1 · Published 2021-02-02

Technologies: bleach (PyPI). Vendors: PyPI.

Executive brief

In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, script, textarea, noframes, iframe, or xmp tags with strip_comments=False.

Affected products

PyPI bleach

Related threats

Mozilla Bleach XSS via unsanitized formaction attribute
Mozilla Bleach ReDoS in linkify with parse_email enabled
Mozilla Bleach URI sanitization bypass via Unicode characters
PYSEC-2020-340 - In Mozilla Bleach before 3.1.4, `bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReD
PYSEC-2020-28 - In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argume