{"id":"CVE-2020-6816","aliases":["ALPINE-CVE-2020-6816","DEBIAN-CVE-2020-6816","DSA-4643-1","EUVD-2020-0055","GHSA-m6xf-fq7q-8743","MGASA-2020-0176","PYSEC-2020-28","UBUNTU-CVE-2020-6816","openSUSE-SU-2021:0552-1","openSUSE-SU-2021:0571-1","openSUSE-SU-2024:11219-1","openSUSE-SU-2024:14134-1","openSUSE-SU-2026:11323-1"],"status":"published","title":"Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag","description":"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0134,"percentile":0.71512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-03-20T00:00:00Z","modified":"2026-11-03T06:32:26Z","fixes":[{"ecosystem":"PyPI","package":"bleach","fixed_in":["3.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.11","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-bleach","fixed_in":["3.1.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-bleach","fixed_in":["3.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-bleach","fixed_in":["3.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-bleach","fixed_in":["3.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"python-bleach","fixed_in":["3.1.2-0+deb10u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-bleach","fixed_in":["1.4.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-bleach","fixed_in":["2.1.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-bleach","fixed_in":["3.1.1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-0+deb10u1"}]}],"versions":["3.1.0-1","3.1.0-2","3.1.1-0+deb10u1","3.1.1-1"]},{"source":"osv","ecosystem":"PyPI","package":"bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2"}]}],"versions":["0.1","0.1.1","0.1.2","0.2","0.2.1","0.2.2","0.3","0.3.1","0.3.3","0.3.4","0.5.0","0.5.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2","1.2.1","1.2.2","1.4","1.4.1","1.4.2","1.4.3","1.5.0","2.0.0","2.1","2.1.1","2.1.2","2.1.3","2.1.4","3.0.0","3.0.1","3.0.2","3.1.0","3.1.1"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2"}]}],"versions":["0.1","0.1.1","0.1.2","0.2","0.2.1","0.2.2","0.3","0.3.1","0.3.3","0.3.4","0.5.0","0.5.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2","1.2.1","1.2.2","1.4","1.4.1","1.4.2","1.4.3","1.5.0","2.0.0","2.1","2.1.1","2.1.2","2.1.3","2.1.4","3.0.0","3.0.1","3.0.2","3.1.0","3.1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1ubuntu0.1~esm1"}]}],"versions":["1.4-1","1.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.0-1","2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-1ubuntu0.1~esm1"}]}],"versions":["3.1.0-1","3.1.0-2","3.1.1-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-lp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-bp152.2.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-1.5"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1.1"}]}],"bundled":5}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mozilla","product":"bleach"},{"vendor":"mozilla","product":"mozilla bleach"}],"references":[{"url":"https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2020-4277","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","advisory"]},{"url":"https://github.com/mozilla/bleach/releases/tag/v3.1.2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6816","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2020-28.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m6xf-fq7q-8743"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-6816","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-6816","tags":["advisory"]},{"url":"https://github.com/mozilla/bleach","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0176.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26445","tags":["report"]},{"url":"https://www.debian.org/security/2020/dsa-4643","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2167","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26379","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-6816","tags":["report"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1621692","tags":["report"]},{"url":"https://github.com/mozilla/bleach/commit/175f67740e7951e1d80cefb7831e6c3e4efeb986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6816","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8077-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YFAKMJGUZHUTZ53ZAID6PRVP5MSLXPGV/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1167379","tags":["report"]},{"url":"https://bugzilla.suse.com/1168280","tags":["report"]},{"url":"https://bugzilla.suse.com/1184547","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23980","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UAZHEWM4ZYBZY5GDDDOMIZYEGFNANLKS/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6802","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-6816","description":"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.","status":"published","published":"2020-03-24T21:15:40Z","modified":"2024-08-04T09:11:05.111Z","updated_at":"2026-11-02T14:35:52.592504Z"}],"euvd":[{"id":"EUVD-2020-0055","description":"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.","status":"published","published":"2020-03-24T21:15:40Z","modified":"2024-08-04T09:11:05Z","updated_at":"2026-11-03T03:08:01.566283Z"}],"ghsa":[{"id":"GHSA-m6xf-fq7q-8743","title":"Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag","description":"### Impact\n\nA [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:\n\n* the `svg` or `math` in the allowed/whitelisted tags\n* an RCDATA tag (see below) in the allowed/whitelisted tags\n* the keyword argument `strip=False`\n\n### Patches\n\nUsers are encouraged to upgrade to bleach v3.1.2 or greater.\n\n### Workarounds\n\n* modify `bleach.clean` calls to use `strip=True`, or not whitelist `math` or `svg` tags and one or more of the following tags:\n\n```\nscript\nnoscript\nstyle\nnoframes\nxmp\nnoembed\niframe\n```\n\n* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=1621692\n* https://cure53.de/fp170.pdf\n* https://nvd.nist.gov/vuln/detail/CVE-2020-6816\n* https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach\n\n### Credits\n\n* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)\n* Email us at [security@mozilla.org](mailto:security@mozilla.org)","status":"published","published":"2020-03-24T15:06:32Z","modified":"2024-09-12T20:49:32Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:02.014847Z"}],"nvd":[{"id":"CVE-2020-6816","description":"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.","status":"published","published":"2020-03-24T22:15:12.657Z","modified":"2026-06-17T03:23:51.57Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:56.580228Z"}],"osv":[{"id":"ALPINE-CVE-2020-6816","description":"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.","status":"published","published":"2020-03-24T22:15:12.657Z","modified":"2026-11-03T06:32:26.193486598Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-6816","description":"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.","status":"published","published":"2020-03-24T22:15:12.657Z","modified":"2026-10-20T10:53:29.593166215Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"DEBIAN-CVE-2020-6816","description":"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.","status":"published","published":"2020-03-24T22:15:12.657Z","modified":"2026-10-26T12:02:33.405004978Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-m6xf-fq7q-8743","title":"Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag","description":"### Impact\n\nA [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:\n\n* the `svg` or `math` in the allowed/whitelisted tags\n* an RCDATA tag (see below) in the allowed/whitelisted tags\n* the keyword argument `strip=False`\n\n### Patches\n\nUsers are encouraged to upgrade to bleach v3.1.2 or greater.\n\n### Workarounds\n\n* modify `bleach.clean` calls to use `strip=True`, or not whitelist `math` or `svg` tags and one or more of the following tags:\n\n```\nscript\nnoscript\nstyle\nnoframes\nxmp\nnoembed\niframe\n```\n\n* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=1621692\n* https://cure53.de/fp170.pdf\n* https://nvd.nist.gov/vuln/detail/CVE-2020-6816\n* https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach\n\n### Credits\n\n* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)\n* Email us at [security@mozilla.org](mailto:security@mozilla.org)","status":"published","published":"2020-03-24T15:06:32Z","modified":"2026-07-08T06:00:46.400344992Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"UBUNTU-CVE-2020-6816","description":"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.","status":"published","published":"2020-03-24T22:15:00Z","modified":"2026-03-09T11:19:30.727766Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"DSA-4643-1","title":"python-bleach - security update","status":"published","published":"2020-03-20T00:00:00Z","modified":"2026-03-09T02:08:46.056847Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0176","title":"Updated python-bleach packages fix security vulnerability","description":"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA\nand either svg or math tags are whitelisted and the keyword argument\nstrip=False. (CVE-2020-6816)\n\nRegular expression denial of service. (CVE-2020-6817)\n","status":"published","published":"2020-04-20T14:02:32Z","modified":"2026-04-16T04:43:30.53969822Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2021:0552-1","title":"Security update for python-bleach","description":"This update for python-bleach fixes the following issues:\n\n- CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific\n  combinations of allowed tags (boo#1184547)\n\nUpdate to 3.1.5:\n\n* replace missing ``setuptools`` dependency with ``packaging``. Thank you Benjamin Peterson.\n\nUpdate to 3.1.4 (boo#1168280, CVE-2020-6817):\n\n* ``bleach.clean`` behavior parsing style attributes could result in a\n  regular expression denial of service (ReDoS).\n  Calls to ``bleach.clean`` with an allowed tag with an allowed\n  ``style`` attribute were vulnerable to ReDoS. For example,\n  ``bleach.clean(..., attributes={'a': ['style']})``.\n* Style attributes with dashes, or single or double quoted values are\n  cleaned instead of passed through.\n\nupdate to 3.1.3 (boo#1167379, CVE-2020-6816):\n\n* Add relative link to code of conduct. (#442)\n* Drop deprecated 'setup.py test' support. (#507)\n* Fix typo: curren -\u003e current in tests/test_clean.py (#504)\n* Test on PyPy 7\n* Drop test support for end of life Python 3.4\n* ``bleach.clean`` behavior parsing embedded MathML and SVG content\n  with RCDATA tags did not match browser behavior and could result in\n  a mutation XSS.\n  Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or\n  ``svg`` tags and one or more of the RCDATA tags ``script``,\n  ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or\n  ``xmp`` in the allowed tags whitelist were vulnerable to a mutation\n  XSS.\n","status":"published","published":"2021-04-14T14:51:29Z","modified":"2026-02-04T03:50:20.948699Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0571-1","title":"Security update for python-bleach","description":"This update for python-bleach fixes the following issues:\n\n- CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific\n  combinations of allowed tags (boo#1184547)\n\nUpdate to 3.1.5:\n\n* replace missing ``setuptools`` dependency with ``packaging``. Thank you Benjamin Peterson.\n\nUpdate to 3.1.4 (boo#1168280, CVE-2020-6817):\n\n* ``bleach.clean`` behavior parsing style attributes could result in a\n  regular expression denial of service (ReDoS).\n  Calls to ``bleach.clean`` with an allowed tag with an allowed\n  ``style`` attribute were vulnerable to ReDoS. For example,\n  ``bleach.clean(..., attributes={'a': ['style']})``.\n* Style attributes with dashes, or single or double quoted values are\n  cleaned instead of passed through.\n\nupdate to 3.1.3 (boo#1167379, CVE-2020-6816):\n\n* Add relative link to code of conduct. (#442)\n* Drop deprecated 'setup.py test' support. (#507)\n* Fix typo: curren -\u003e current in tests/test_clean.py (#504)\n* Test on PyPy 7\n* Drop test support for end of life Python 3.4\n* ``bleach.clean`` behavior parsing embedded MathML and SVG content\n  with RCDATA tags did not match browser behavior and could result in\n  a mutation XSS.\n  Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or\n  ``svg`` tags and one or more of the RCDATA tags ``script``,\n  ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or\n  ``xmp`` in the allowed tags whitelist were vulnerable to a mutation\n  XSS.\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-04-17T22:05:12Z","modified":"2026-02-04T03:59:05.71164Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11219-1","title":"python36-bleach-3.3.0-1.4 on GA media","description":"These are all security issues fixed in the python36-bleach-3.3.0-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:41:03.69776Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14134-1","title":"python310-bleach-6.1.0-1.5 on GA media","description":"These are all security issues fixed in the python310-bleach-6.1.0-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2025-05-07T18:10:19.482546Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11323-1","title":"python313-bleach-6.4.0-1.1 on GA media","description":"These are all security issues fixed in the python313-bleach-6.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-21T00:00:00Z","modified":"2026-07-22T09:30:06.046081622Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2020-28","description":"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.","status":"published","published":"2020-03-24T22:15:00Z","modified":"2023-11-08T04:03:57.116894Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}