Matthiask Html-Sanitizer vulnerabilities

1 known vulnerability affecting matthiask/html-sanitizer.

Total CVEs

1

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

MEDIUM1

Vulnerabilities

Page 1 of 1

CVE-2024-34078MEDIUMCVSS 6.1fixed in 2.4.22024-05-06

CVE-2024-34078 [MEDIUM] CWE-79 CVE-2024-34078: html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (whi html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.