A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

🗓️ 03 Sep 2025 21:19:28Reported by MicrosoftType

Mutation XSS when bleach.clean allows svg or math in p or br and tags with strip_comments False.

Reporter	Title	Published	Views	Family All 58
AlpineLinux	CVE-2021-23980	16 Feb 202300:00	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в python-bleach	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the bleach-based HTML cleaning library, which exists due to the lack of measures taken to protect the structure of web pages, allows attackers to compromise the confidentiality and integrity of the protected information.	23 Jun 202100:00	–	bdu_fstec
Circl	CVE-2021-23980	17 Feb 202300:18	–	circl
CNNVD	Python Bleach 跨站脚本漏洞	6 Apr 202100:00	–	cnnvd
CVE	CVE-2021-23980	16 Feb 202300:00	–	cve
Cvelist	CVE-2021-23980	16 Feb 202300:00	–	cvelist
Debian	[SECURITY] [DLA 2620-1] python-bleach security update	6 Apr 202112:22	–	debian
Debian	[SECURITY] [DSA 4892-1] python-bleach security update	18 Apr 202114:41	–	debian
Debian	[SECURITY] [DSA 4892-1] python-bleach security update	18 Apr 202114:41	–	debian