CVE-2020-6816: Fedoraproject Fedora

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.

Affected products

• Fedoraproject Fedora: version 33 only
• Mozilla Bleach: before 3.1.2 (fixed in 3.1.2)

Published 2020-03-24. Last modified 2026-06-17.