Policies not properly enforced in bluemonday
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-42576US | critical9.8 | — | ||
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION eleme… | ||||
02
references
External citations — patches, advisories, analysis.
- https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50WEB
- https://github.com/advisories/GHSA-x95h-979x-cf3jADVISORY
- https://github.com/microcosm-cc/bluemondayPACKAGE
- https://github.com/microcosm-cc/bluemonday/commit/c788a2a4d42e081ad54a31368478820bb4a42fb4WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/pybluemonday/PYSEC-2021-849.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-42576ADVISORY
- https://pkg.go.dev/vuln/GO-2022-0588WEB
- https://pypi.org/project/pybluemondayWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan