Mozilla Bleach XSS via unsanitized formaction attribute

Severity: medium · CVSS 6.1 · Published 2026-06-16

Bleach is a popular Python library used to clean and sanitize untrusted HTML to prevent security risks. A flaw was found where it fails to properly check the 'formaction' attribute, which can allow malicious JavaScript to be embedded in buttons or form inputs. If an application is configured to allow this specific attribute, an attacker could execute code in a user's browser when they click a button, potentially leading to unauthorized actions or data theft.

Technologies: bleach (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.1, published 16 June 2026.
Which products and versions are affected?
bleach (PyPI) < 6.4.0.
Is there a fix for This vulnerability?
A patch was published on 2026-06-16: Version 6.4.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run bleach (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A URI-sanitization coverage gap exists in Bleach's 'BleachSanitizerFilter.allow_token' logic. While attributes like 'action' and 'src' are included in the 'attr_val_is_uri' list for protocol validation, 'formaction' was omitted. If a downstream application explicitly allows 'formaction' on submit-capable controls (such as <button>, <input type='submit'>, or <input type='image'>), Bleach will preserve 'javascript:' URIs instead of stripping them. This allows for submit-triggered JavaScript execution (XSS) when a user interacts with the affected element. The issue is resolved in version 6.4.0 by adding 'formaction' to the internal URI validation list.

Affected products

  • mozilla bleach < 6.4.0

Timeline

  • 2026-06-05: disclosed: Initial disclosure to mozilla/bleach
  • 2026-06-16: advisory: GitHub Advisory published
  • 2026-06-16: patched: Version 6.4.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.