Policies not properly enforced in bluemonday

2021-10-1920:15:30

Google

osv.dev

0.003 Low

EPSS

Percentile

71.7%

JSON

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

CPENameOperatorVersion
pybluemondayeq0.0.3
pybluemondayeq0.0.1
github.com/microcosm-cc/bluemondaylt1.0.16
pybluemondayeq0.0.5
pybluemondayeq0.0.4
pybluemondayeq0.0.2
pybluemondayeq0.0.6
pybluemondayeq0.0.7

Name	Operator	Version
pybluemonday	eq	0.0.3
pybluemonday	eq	0.0.1
github.com/microcosm-cc/bluemonday	lt	1.0.16
pybluemonday	eq	0.0.5
pybluemonday	eq	0.0.4
pybluemonday	eq	0.0.2
pybluemonday	eq	0.0.6
pybluemonday	eq	0.0.7