GitHub Advisoryadvisory · PyPI

GHSA-m9mq-p2f9-cfqv Bleach URI Scheme Restriction Bypass

CRITICAL Published 2019-01-04 Modified 2024-09-04 Official page ↗
Aliases
CVE-2018-7753
Ecosystem
PyPI
Packages
bleach
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• PyPI bleach: >= 2.1.0, < 2.1.3 → fixed in 2.1.3

Description

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.

Related

Alias · CVE (1)

  • CVE-2018-7753 An issue was discovered in Bleach 2.1.x before 2.1.3. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References