{"id":"CVE-2021-23980","aliases":["ALPINE-CVE-2021-23980","DEBIAN-CVE-2021-23980","DLA-2620-1","DSA-4892-1","EUVD-2021-0036","GHSA-vv2x-vrpj-qqpq","MGASA-2021-0260","OESA-2022-1861","PYSEC-2021-865","RHSA-2021:0781","UBUNTU-CVE-2021-23980","openSUSE-SU-2021:0552-1","openSUSE-SU-2021:0571-1","openSUSE-SU-2024:11219-1","openSUSE-SU-2024:14134-1","openSUSE-SU-2026:11323-1"],"status":"published","title":"Cross-site scripting in Bleach","description":"A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00483,"percentile":0.41882,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-02-02T17:58:00Z","modified":"2026-11-03T06:32:38Z","fixes":[{"ecosystem":"PyPI","package":"bleach","fixed_in":["3.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-bleach","fixed_in":["3.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-bleach","fixed_in":["3.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-bleach","fixed_in":["3.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-bleach","fixed_in":["3.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-bleach","fixed_in":["3.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-bleach","fixed_in":["3.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-bleach","fixed_in":["3.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-bleach","fixed_in":["3.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-bleach","fixed_in":["3.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-bleach","fixed_in":["3.3.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-bleach","fixed_in":["3.2.1-2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-bleach","fixed_in":["3.2.1-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-bleach","fixed_in":["3.2.1-2.1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"python-bleach","fixed_in":["2.0-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"python-bleach","fixed_in":["3.1.2-0+deb10u2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"python-bleach","fixed_in":["3.1.4-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-bleach","fixed_in":["3.3.0-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-bleach","fixed_in":["5.0.1-1.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-bleach","fixed_in":["1.4.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-bleach","fixed_in":["2.1.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-bleach","fixed_in":["3.1.1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-2.1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-1+deb9u1"}]}],"versions":["2.0-1"]},{"source":"osv","ecosystem":"Debian:10","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-0+deb10u2"}]}],"versions":["3.1.0-1","3.1.0-2","3.1.1-0+deb10u1","3.1.1-1","3.1.2-0+deb10u1"]},{"source":"osv","ecosystem":"PyPI","package":"bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0"}]}],"versions":["0.1","0.1.1","0.1.2","0.2","0.2.1","0.2.2","0.3","0.3.1","0.3.3","0.3.4","0.5.0","0.5.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2","1.2.1","1.2.2","1.4","1.4.1","1.4.2","1.4.3","1.5.0","2.0.0","2.1","2.1.1","2.1.2","2.1.3","2.1.4","3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.2.0","3.2.1","3.2.2","3.2.3"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1.oe2203"}]}]},{"source":"osv","ecosystem":"PyPI","package":"bleach","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"79b7a3c5e56a09d1d323a5006afa59b56162eb13"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0"}]}],"versions":["0.1","0.1.1","0.1.2","0.2","0.2.1","0.2.2","0.3","0.3.1","0.3.3","0.3.4","0.5.0","0.5.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2","1.2.1","1.2.2","1.4","1.4.1","1.4.2","1.4.3","1.5.0","2.0.0","2.1","2.1.1","2.1.2","2.1.3","2.1.4","3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.2.0","3.2.1","3.2.2","3.2.3"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python-bleach-allowlist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.15-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.5.6-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-bleach-allowlist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.18-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.15-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el7","package":"python3-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.5.6-1.el7pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python-bleach-allowlist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.15-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.5.6-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-bleach-allowlist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.18-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.15-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:4.2::el8","package":"python3-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.5.6-1.el8pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1ubuntu0.1~esm1"}]}],"versions":["1.4-1","1.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.0-1","2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-1ubuntu0.1~esm1"}]}],"versions":["3.1.0-1","3.1.0-2","3.1.1-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-lp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-bp152.2.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-1.5"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-bleach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1.1"}]}],"bundled":5}],"products":[{"vendor":"mozilla","product":"bleach"},{"vendor":"mozilla","product":"mozilla bleach"}],"references":[{"url":"https://github.com/mozilla/bleach/security/advisories/GHSA-vv2x-vrpj-qqpq","tags":["x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-23980","tags":["x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://github.com/mozilla/bleach/commit/79b7a3c5e56a09d1d323a5006afa59b56162eb13","tags":["web","fix","report"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1689399","tags":["web","report"]},{"url":"https://cure53.de/fp170.pdf","tags":["web"]},{"url":"https://github.com/mozilla/bleach/blob/79b7a3c5e56a09d1d323a5006afa59b56162eb13/CHANGES#L4","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23980","tags":["advisory"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2021-4303","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2021-865.yaml","tags":["web"]},{"url":"https://pypi.org/project/bleach","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vv2x-vrpj-qqpq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-23980","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23980","tags":["advisory"]},{"url":"https://github.com/mozilla/bleach","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0260.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28986","tags":["report"]},{"url":"https://www.debian.org/security/2021/dsa-4892.en.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YFAKMJGUZHUTZ53ZAID6PRVP5MSLXPGV/","tags":["web","advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1861","tags":["advisory"]},{"url":"ttps://bugzilla.mozilla.org/show_bug.cgi?id=1689399","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0781","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922136","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0781.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7789","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7789","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-AJV-584908","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3281","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20270","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20270","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20270","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23980","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940603","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27291","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23980","tags":["report"]},{"url":"https://github.com/mozilla/bleach/commit/d398c89e54ced6b1039d3677689707456ba42dec","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8077-1","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1167379","tags":["report"]},{"url":"https://bugzilla.suse.com/1168280","tags":["report"]},{"url":"https://bugzilla.suse.com/1184547","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23980","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UAZHEWM4ZYBZY5GDDDOMIZYEGFNANLKS/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6802","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-23980","description":"A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.","status":"published","published":"2023-02-16T00:00:00Z","modified":"2025-03-19T15:18:23.189Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-0036","description":"A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.","status":"published","published":"2023-02-16T00:00:00Z","modified":"2025-03-19T15:18:23Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:59.10334Z"}],"ghsa":[{"id":"GHSA-vv2x-vrpj-qqpq","title":"Cross-site scripting in Bleach","description":"### Impact                                                                                                                                                                                                                                                    \n\nA [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:\n\n* `svg` or `math` in the allowed tags\n* `p` or `br` in allowed tags\n* `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags\n* the keyword argument `strip_comments=False`\n\nNote: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.\n\n### Patches\n\nUsers are encouraged to upgrade to bleach v3.3.0 or greater.\n\nNote: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.\n\n### Workarounds\n\n* modify `bleach.clean` calls to at least one of:\n  * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag\n  * not allow `svg` or `math` tags\n  * not allow `p` or `br` tags\n  * set `strip_comments=True`\n\n* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399\n* https://advisory.checkmarx.net/advisory/CX-2021-4303\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980\n* https://cure53.de/fp170.pdf\n\n### Credits\n\n* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx\n* Additional eject tags not mentioned in the original advisory and the CSP mitigation line being truncated in the revised advisory reported by [Michał Bentkowski](https://twitter.com/SecurityMB) at Securitum\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)\n* Email us at [security@mozilla.org](mailto:security@mozilla.org)","status":"published","published":"2021-02-02T17:58:40Z","modified":"2024-09-13T15:15:58Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:02.773864Z"}],"nvd":[{"id":"CVE-2021-23980","description":"A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.","status":"published","published":"2023-02-16T22:15:10.713Z","modified":"2026-06-17T03:39:06.3Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:07.323379Z"}],"osv":[{"id":"ALPINE-CVE-2021-23980","description":"A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.","status":"published","published":"2023-02-16T22:15:10.713Z","modified":"2026-11-03T06:32:38.522215523Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2021-23980","description":"A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.","status":"published","published":"2023-02-16T22:15:10.713Z","modified":"2026-10-20T10:54:32.586930689Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-23980","description":"A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.","status":"published","published":"2023-02-16T22:15:10.713Z","modified":"2026-10-23T18:02:52.515537663Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-vv2x-vrpj-qqpq","title":"Cross-site scripting in Bleach","description":"### Impact                                                                                                                                                                                                                                                    \n\nA [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:\n\n* `svg` or `math` in the allowed tags\n* `p` or `br` in allowed tags\n* `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags\n* the keyword argument `strip_comments=False`\n\nNote: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.\n\n### Patches\n\nUsers are encouraged to upgrade to bleach v3.3.0 or greater.\n\nNote: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.\n\n### Workarounds\n\n* modify `bleach.clean` calls to at least one of:\n  * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag\n  * not allow `svg` or `math` tags\n  * not allow `p` or `br` tags\n  * set `strip_comments=True`\n\n* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399\n* https://advisory.checkmarx.net/advisory/CX-2021-4303\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980\n* https://cure53.de/fp170.pdf\n\n### Credits\n\n* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx\n* Additional eject tags not mentioned in the original advisory and the CSP mitigation line being truncated in the revised advisory reported by [Michał Bentkowski](https://twitter.com/SecurityMB) at Securitum\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)\n* Email us at [security@mozilla.org](mailto:security@mozilla.org)","status":"published","published":"2021-02-02T17:58:40Z","modified":"2026-07-08T06:27:25.98148864Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"OESA-2022-1861","title":"python-bleach security update","description":"Bleach is an HTML sanitizing library that escapes or strips markup and attributes based on a white list.\r\n\r\nSecurity Fix(es):\r\n\r\nNo description is available for this CVE.(CVE-2021-23980)","status":"published","published":"2022-08-26T11:05:08Z","modified":"2026-08-18T01:17:09.454272613Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2021:0781","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 1.2.2 security and bug fix update","status":"published","published":"2024-09-18T04:17:10Z","modified":"2026-06-28T10:42:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2021-23980","description":"A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.","status":"published","published":"2023-02-16T22:15:00Z","modified":"2026-03-09T11:22:27.35335Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-2620-1","title":"python-bleach - security update","status":"published","published":"2021-04-06T00:00:00Z","modified":"2026-03-09T01:19:55.046946Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4892-1","title":"python-bleach - security update","status":"published","published":"2021-04-18T00:00:00Z","modified":"2026-03-09T02:09:53.603083Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0260","title":"Updated python-bleach packages fix a security vulnerability","description":"It was reported that python-bleach, a whitelist-based HTML-sanitizing \nlibrary, is prone to a mutation XSS vulnerability in bleach.clean when \"svg\" \nor \"math\" are in the allowed tags, 'p' or \"br\" are in allowed tags, \"style\", \n\"title\", \"noscript\", \"script\", \"textarea\", \"noframes\", \"iframe\", or \"xmp\" are \nin allowed tags and 'strip_comments=False' is set (CVE-2021-23980).\n","status":"published","published":"2021-06-16T20:22:25Z","modified":"2026-04-16T04:43:35.271266118Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0552-1","title":"Security update for python-bleach","description":"This update for python-bleach fixes the following issues:\n\n- CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific\n  combinations of allowed tags (boo#1184547)\n\nUpdate to 3.1.5:\n\n* replace missing ``setuptools`` dependency with ``packaging``. Thank you Benjamin Peterson.\n\nUpdate to 3.1.4 (boo#1168280, CVE-2020-6817):\n\n* ``bleach.clean`` behavior parsing style attributes could result in a\n  regular expression denial of service (ReDoS).\n  Calls to ``bleach.clean`` with an allowed tag with an allowed\n  ``style`` attribute were vulnerable to ReDoS. For example,\n  ``bleach.clean(..., attributes={'a': ['style']})``.\n* Style attributes with dashes, or single or double quoted values are\n  cleaned instead of passed through.\n\nupdate to 3.1.3 (boo#1167379, CVE-2020-6816):\n\n* Add relative link to code of conduct. (#442)\n* Drop deprecated 'setup.py test' support. (#507)\n* Fix typo: curren -\u003e current in tests/test_clean.py (#504)\n* Test on PyPy 7\n* Drop test support for end of life Python 3.4\n* ``bleach.clean`` behavior parsing embedded MathML and SVG content\n  with RCDATA tags did not match browser behavior and could result in\n  a mutation XSS.\n  Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or\n  ``svg`` tags and one or more of the RCDATA tags ``script``,\n  ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or\n  ``xmp`` in the allowed tags whitelist were vulnerable to a mutation\n  XSS.\n","status":"published","published":"2021-04-14T14:51:29Z","modified":"2026-02-04T03:50:20.948699Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0571-1","title":"Security update for python-bleach","description":"This update for python-bleach fixes the following issues:\n\n- CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific\n  combinations of allowed tags (boo#1184547)\n\nUpdate to 3.1.5:\n\n* replace missing ``setuptools`` dependency with ``packaging``. Thank you Benjamin Peterson.\n\nUpdate to 3.1.4 (boo#1168280, CVE-2020-6817):\n\n* ``bleach.clean`` behavior parsing style attributes could result in a\n  regular expression denial of service (ReDoS).\n  Calls to ``bleach.clean`` with an allowed tag with an allowed\n  ``style`` attribute were vulnerable to ReDoS. For example,\n  ``bleach.clean(..., attributes={'a': ['style']})``.\n* Style attributes with dashes, or single or double quoted values are\n  cleaned instead of passed through.\n\nupdate to 3.1.3 (boo#1167379, CVE-2020-6816):\n\n* Add relative link to code of conduct. (#442)\n* Drop deprecated 'setup.py test' support. (#507)\n* Fix typo: curren -\u003e current in tests/test_clean.py (#504)\n* Test on PyPy 7\n* Drop test support for end of life Python 3.4\n* ``bleach.clean`` behavior parsing embedded MathML and SVG content\n  with RCDATA tags did not match browser behavior and could result in\n  a mutation XSS.\n  Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or\n  ``svg`` tags and one or more of the RCDATA tags ``script``,\n  ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or\n  ``xmp`` in the allowed tags whitelist were vulnerable to a mutation\n  XSS.\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-04-17T22:05:12Z","modified":"2026-02-04T03:59:05.71164Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11219-1","title":"python36-bleach-3.3.0-1.4 on GA media","description":"These are all security issues fixed in the python36-bleach-3.3.0-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:41:03.69776Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14134-1","title":"python310-bleach-6.1.0-1.5 on GA media","description":"These are all security issues fixed in the python310-bleach-6.1.0-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2025-05-07T18:10:19.482546Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11323-1","title":"python313-bleach-6.4.0-1.1 on GA media","description":"These are all security issues fixed in the python313-bleach-6.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-21T00:00:00Z","modified":"2026-07-22T09:30:06.046081622Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2021-865","description":"In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, script, textarea, noframes, iframe, or xmp tags with strip_comments=False.","status":"published","published":"2021-02-02T17:58:00Z","modified":"2023-11-08T04:05:14.16654Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}