Skip to content
OpenAdvisories
Medium DLA-3856-1 1 CVE

python-html-sanitizer - security update

Published Aug 26, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 python-html-sanitizer 1.9.1-2+deb11u1

Vulnerabilities 1

  • Medium 6.1
    CVE-2024-34078

    html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization

    html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted …

    matthiask html-sanitizer python-html-sanitizer html-sanitizer Debian Ubuntu PyPI