CVE-2024-34078: Matthiask Html-Sanitizer

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.

Affected products

• Matthiask Html-Sanitizer: before 2.4.2 (fixed in 2.4.2)

Published 2024-05-06. Last modified 2026-06-17.