GitHub Advisoryadvisory · PyPI

GHSA-wvhx-q427-fgh3 Arbitrary HTML present after sanitization because of unicode normalization

HIGH Published 2024-05-06 Modified 2024-05-06 Official page ↗
Aliases
CVE-2024-34078
Ecosystem
PyPI
Packages
html-sanitizer
Severity
High
Reviewed
2024-05-06

Affected packages

• PyPI html-sanitizer: < 2.4.2 → fixed in 2.4.2

Description

Impact If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. Patches The problem has been fixed in 2.4.2. Workarounds Set `keep_typographic_whitespace=True` explicitly, or normalize to NFKC yourself earlier.

Related

Alias · CVE (1)

  • CVE-2024-34078 html-sanitizer is an allowlist-based HTML cleaner. vulnerability

References