5 results · Clear filters · Feed
-
Medium 6.1
Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
### Summary Bleach `clean()` / `Cleaner()` fails to sanitize dangerous URI schemes in allowed `formaction` attributes. Bleach applies URI protocol sanitization only to attributes listed in `attr_val_is_uri`. While URI-bearing attributes such as `action`, `hre…
-
Medium 4.3
Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning
## Summary Bleach 6.3.0 exposes a documented email-linkification path through `bleach.linkify(..., parse_email=True)`. The implementation scans attacker-controlled text with `EMAIL_RE.finditer()` over the full character token and has no length, timeout, or li…
-
Medium 6.1
Cross-site scripting in Bleach
A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of t…
-
Medium 6.1
Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag
In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.
-
Medium 6.1
XSS in Bleach when noscript and raw tag whitelisted
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.