CVE-2021-29272: Microco Bluemonday

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.

Affected products

• Microco Bluemonday: before 1.0.5 (fixed in 1.0.5)

Published 2021-03-27. Last modified 2026-06-17.