In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.
[
{
"product": "Mozilla Bleach",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "<=3.11"
}
]
}
]