Skip to content
OpenAdvisories

Package · npm

bleach

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-5634-rv46-48jf

    Cross-Site Scripting in bleach

    All versions of `bleach` are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as `"<<script><</script>script>alert('xss');</<script><</script>script>"` regardless of the passed options. This may a…

    bleach npm
  • Medium 5.3
    CVE-2014-8881

    Regular Expression Denial of Service in bleach

    All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. ## Recommendation The `bleach` package is not currently maintained, and has not seen an upd…

    bleach npm