Mozilla Bleach vulnerabilities

5 CVEs affecting Mozilla Bleach, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-23980, published 2023-02-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-7753, published 2018-03-07. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible…
CVE-2020-6802, published 2020-03-24. Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days. In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
CVE-2020-6816, published 2020-03-24. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.
CVE-2020-6817, published 2023-02-16. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable…
CVE-2021-23980, published 2023-02-16. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed…