{"id":"CVE-2020-6802","aliases":["ALPINE-CVE-2020-6802","DEBIAN-CVE-2020-6802","DSA-4636-1","EUVD-2020-0054","GHSA-q65m-pv3f-wr5r","MGASA-2020-0125","PYSEC-2020-27","UBUNTU-CVE-2020-6802","openSUSE-SU-2020:0308-1","openSUSE-SU-2020:0325-1","openSUSE-SU-2024:11219-1","openSUSE-SU-2024:11507-1","openSUSE-SU-2024:14134-1","openSUSE-SU-2026:11323-1"],"status":"published","title":"XSS in Bleach when noscript and raw tag whitelisted","description":"In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01731,"percentile":0.77773,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-02-24T17:33:44Z","modified":"2026-11-03T06:32:37Z","fixes":[{"ecosystem":"PyPI","package":"bleach","fixed_in":["3.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.11","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-bleach","fixed_in":["3.1.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-bleach","fixed_in":["3.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-bleach","fixed_in":["3.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-bleach","fixed_in":["3.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"python-bleach","fixed_in":["3.1.1-0+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"python-bleach","fixed_in":["3.1.1-1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-bleach","fixed_in":["2.1.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"python-bleach","fixed_in":["3.1.1-lp151.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"python-bleach","fixed_in":["3.1.1-bp151.4.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"weblate","fixed_in":["4.8.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-0+deb10u1"}]}],"versions":["3.1.0-1","3.1.0-2"]},{"source":"osv","ecosystem":"PyPI","package":"bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1"}]}],"versions":["0.1","0.1.1","0.1.2","0.2","0.2.1","0.2.2","0.3","0.3.1","0.3.3","0.3.4","0.5.0","0.5.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2","1.2.1","1.2.2","1.4","1.4.1","1.4.2","1.4.3","1.5.0","2.0.0","2.1","2.1.1","2.1.2","2.1.3","2.1.4","3.0.0","3.0.1","3.0.2","3.1.0"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-1.mga7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1"}]}],"versions":["0.1","0.1.1","0.1.2","0.2","0.2.1","0.2.2","0.3","0.3.1","0.3.3","0.3.4","0.5.0","0.5.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2","1.2.1","1.2.2","1.4","1.4.1","1.4.2","1.4.3","1.5.0","2.0.0","2.1","2.1.1","2.1.2","2.1.3","2.1.4","3.0.0","3.0.1","3.0.2","3.1.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.0-1","2.1.2-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-lp151.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-bp151.4.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"weblate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-1.5"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1.1"}]}],"bundled":5}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mozilla","product":"bleach"},{"vendor":"mozilla","product":"mozilla bleach"}],"references":[{"url":"https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCNLM2MGQTOLCIVVYS2Z5S7KOQJR5JC4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/72R4VFFHDRSQMNT7IZU3X2755ZP4HGNI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTULPQB7HVPPYWEYVNHJGDTSPVIDHIZX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","article"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2020-4276","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","advisory"]},{"url":"https://github.com/mozilla/bleach/commit/f77e0f6392177a06e46a49abd61a4d9f035e57fd","tags":["web","report"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1615315","tags":["web","report"]},{"url":"https://cure53.de/fp170.pdf","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6802","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2020-27.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/72R4VFFHDRSQMNT7IZU3X2755ZP4HGNI","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCNLM2MGQTOLCIVVYS2Z5S7KOQJR5JC4","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTULPQB7HVPPYWEYVNHJGDTSPVIDHIZX","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q65m-pv3f-wr5r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-6802","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-6802","tags":["advisory"]},{"url":"https://github.com/mozilla/bleach","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0125.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26286","tags":["report"]},{"url":"https://www.debian.org/security/2020/dsa-4636","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCNLM2MGQTOLCIVVYS2Z5S7KOQJR5JC4/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/72R4VFFHDRSQMNT7IZU3X2755ZP4HGNI/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTULPQB7HVPPYWEYVNHJGDTSPVIDHIZX/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-6802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6802","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8077-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/42YYAZLSUO2H6HI5G3EGIRCDDAHTGJGK/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1165303","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6802","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FWUX2BHDV6ER4EK7BZ3BABNQIAP7B2N2/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23980","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-6802","description":"In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.","status":"published","published":"2020-03-24T21:13:04Z","modified":"2024-08-04T09:11:05.145Z","updated_at":"2026-11-02T14:35:52.592504Z"}],"euvd":[{"id":"EUVD-2020-0054","description":"In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.","status":"published","published":"2020-03-24T21:13:04Z","modified":"2024-08-04T09:11:05Z","updated_at":"2026-11-03T03:08:01.566283Z"}],"ghsa":[{"id":"GHSA-q65m-pv3f-wr5r","title":"XSS in Bleach when noscript and raw tag whitelisted","description":"### Impact\n\nA [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with `noscript` and a raw tag (see below) in the allowed/whitelisted tags option.\n\n### Patches\n\nv3.1.1\n\n### Workarounds\n\n* modify `bleach.clean` calls to not whitelist `noscript` and one or more of the following raw tags:\n\n```\ntitle\ntextarea\nscript\nstyle\nnoembed\nnoframes\niframe\nxmp\n```\n\n* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=1615315\n* https://cure53.de/fp170.pdf\n* https://nvd.nist.gov/vuln/detail/CVE-2020-6802\n* https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach\n\n### Credits\n\n* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)\n* Email us at [security@mozilla.org](mailto:security@mozilla.org)\n","status":"published","published":"2020-02-24T17:33:44Z","modified":"2024-09-13T15:05:53Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:02.773864Z"}],"nvd":[{"id":"CVE-2020-6802","description":"In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.","status":"published","published":"2020-03-24T22:15:12.563Z","modified":"2026-06-17T03:23:50.01Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:56.580228Z"}],"osv":[{"id":"ALPINE-CVE-2020-6802","description":"In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.","status":"published","published":"2020-03-24T22:15:12.563Z","modified":"2026-11-03T06:32:37.656790678Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2020-6802","description":"In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.","status":"published","published":"2020-03-24T22:15:12.563Z","modified":"2026-10-20T10:54:23.366288176Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"DEBIAN-CVE-2020-6802","description":"In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.","status":"published","published":"2020-03-24T22:15:12.563Z","modified":"2026-10-26T12:02:33.412975946Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-q65m-pv3f-wr5r","title":"XSS in Bleach when noscript and raw tag whitelisted","description":"### Impact\n\nA [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with `noscript` and a raw tag (see below) in the allowed/whitelisted tags option.\n\n### Patches\n\nv3.1.1\n\n### Workarounds\n\n* modify `bleach.clean` calls to not whitelist `noscript` and one or more of the following raw tags:\n\n```\ntitle\ntextarea\nscript\nstyle\nnoembed\nnoframes\niframe\nxmp\n```\n\n* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=1615315\n* https://cure53.de/fp170.pdf\n* https://nvd.nist.gov/vuln/detail/CVE-2020-6802\n* https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach\n\n### Credits\n\n* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)\n* Email us at [security@mozilla.org](mailto:security@mozilla.org)\n","status":"published","published":"2020-02-24T17:33:44Z","modified":"2026-07-08T06:29:24.337403709Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"UBUNTU-CVE-2020-6802","description":"In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.","status":"published","published":"2020-03-24T22:15:00Z","modified":"2026-03-09T11:18:42.099936Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"DSA-4636-1","title":"python-bleach - security update","status":"published","published":"2020-02-28T00:00:00Z","modified":"2026-03-09T02:09:43.317553Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0125","title":"Updated python-bleach packages fix security vulnerability","description":"The updated packages fix a security vulnerability:\n\nMutation XSS in bleach.clean when noscript and raw tag whitelisted.\n(CVE-2020-6802)\n","status":"published","published":"2020-03-06T16:13:58Z","modified":"2026-04-16T04:43:26.762276018Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0308-1","title":"Security update for python-bleach","description":"This update for python-bleach to version 3.1.1 fixes the following issue:\n\n- Python-bleach was updated to 3.1.1\n- CVE-2020-6802: Fixed mutation XSS vulnerabilities (boo#1165303).\n","status":"published","published":"2020-03-07T09:14:37Z","modified":"2025-05-07T18:12:13.796452Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0325-1","title":"Security update for python-bleach","description":"This update for python-bleach to version 3.1.1 fixes the following issue:\n\n- Python-bleach was updated to 3.1.1\n- CVE-2020-6802: Fixed mutation XSS vulnerabilities (boo#1165303).\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-03-09T14:18:04Z","modified":"2026-02-04T03:39:14.590417Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11219-1","title":"python36-bleach-3.3.0-1.4 on GA media","description":"These are all security issues fixed in the python36-bleach-3.3.0-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:41:03.69776Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11507-1","title":"weblate-4.8.1-1.1 on GA media","description":"These are all security issues fixed in the weblate-4.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:22:36.354442Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:14134-1","title":"python310-bleach-6.1.0-1.5 on GA media","description":"These are all security issues fixed in the python310-bleach-6.1.0-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2025-05-07T18:10:19.482546Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11323-1","title":"python313-bleach-6.4.0-1.1 on GA media","description":"These are all security issues fixed in the python313-bleach-6.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-21T00:00:00Z","modified":"2026-07-22T09:30:06.046081622Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2020-27","description":"In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.","status":"published","published":"2020-03-24T22:15:00Z","modified":"2023-11-08T04:03:57.05647Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}