GitHub Advisoryadvisory · PyPI, Go
GHSA-x95h-979x-cf3j Policies not properly enforced in bluemonday
HIGH
Official page ↗
- Aliases
- CVE-2021-42576
- Ecosystem
- PyPI, Go
- Packages
- pybluemonday, github.com/microcosm-cc/bluemonday
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20
- Reviewed
- 2021-10-19
Affected packages
• PyPI pybluemonday: < 0.0.8 → fixed in 0.0.8
• Go github.com/microcosm-cc/bluemonday: < 1.0.16 → fixed in 1.0.16
Description
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Related
Alias · CVE (1)
- CVE-2021-42576 The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-42576 advisory
- https://github.com/microcosm-cc/bluemonday/commit/c788a2a4d42e081ad54a31368478820bb4a42fb4 web
- https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50 web
- https://github.com/advisories/GHSA-x95h-979x-cf3j advisory
- https://github.com/microcosm-cc/bluemonday package
- https://github.com/pypa/advisory-database/tree/main/vulns/pybluemonday/PYSEC-2021-849.yaml web
- https://pkg.go.dev/vuln/GO-2022-0588 web
- https://pypi.org/project/pybluemonday web