github.com/microcosm-cc/bluemonday

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Medium 6.1

CVE-2021-29272

Cross-site scripting in bluemonday

bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.

gitea github.com/microcosm-cc/bluemonday golang-github-microcosm-cc-bluemonday Ubuntu Alpine Go

Mar 27, 2021