CVE-2021-23980: Mozilla Bleach

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

Affected products

• Mozilla Bleach: before 3.3.0 (fixed in 3.3.0)

Published 2023-02-16. Last modified 2026-06-17.