Bleach
10 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Bleach, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Bleach CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 3 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 10 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High1
- Medium3
Latest CVEs
The 10 most recently published vulnerabilities affecting Bleach.
- GHSA-gj48-438w-jh9vBleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes—
- GHSA-g75f-g53v-794xBleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning—
- GHSA-8rfp-98v4-mmr6Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output—
- CVE-2021-23980A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed ...6.1
- CVE-2020-6817bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerab...7.5
- GHSA-5634-rv46-48jfCross-Site Scripting in bleach—
- CVE-2014-8881Regular Expression Denial of Service in bleach—
- CVE-2020-6816In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.6.1
- CVE-2020-6802In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.6.1
- CVE-2018-7753An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possibl...9.8
Product grouping is registry-driven, with AI assist and human review. How it works