In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-bleach | Aug 22, 2024 | Mar 24, 2020 |
| Debian | — | Upgrade python-bleach | Mar 23, 2020 | Mar 23, 2020 |
| Suse | — | Upgrade python2-bleachUpgrade python3-bleach | Apr 15, 2021 | Mar 24, 2020 |
| Ubuntu | — | Upgrade python-bleach (Ubuntu Pro)Upgrade python3-bleach (Ubuntu Pro)Upgrade python-bleach-doc (Ubuntu Pro) | Jun 26, 2025 | Mar 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub