Executive brief
Bleach is a popular Python library used to clean and sanitize untrusted HTML to prevent security risks. A flaw was found where it fails to properly check the 'formaction' attribute, which can allow malicious JavaScript to be embedded in buttons or form inputs. If an application is configured to allow this specific attribute, an attacker could execute code in a user's browser when they click a button, potentially leading to unauthorized actions or data theft.
Technical details
A URI-sanitization coverage gap exists in Bleach's 'BleachSanitizerFilter.allow_token' logic. While attributes like 'action' and 'src' are included in the 'attr_val_is_uri' list for protocol validation, 'formaction' was omitted. If a downstream application explicitly allows 'formaction' on submit-capable controls (such as <button>, <input type='submit'>, or <input type='image'>), Bleach will preserve 'javascript:' URIs instead of stripping them. This allows for submit-triggered JavaScript execution (XSS) when a user interacts with the affected element. The issue is resolved in version 6.4.0 by adding 'formaction' to the internal URI validation list.
Affected products
- mozilla bleach < 6.4.0
Timeline
- 2026-06-05: disclosed: Initial disclosure to mozilla/bleach
- 2026-06-16: advisory: GitHub Advisory published
- 2026-06-16: patched: Version 6.4.0 released