bleach

====== Bleach NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes. Bleach can also linkify text safely, applying filters th...

Security Bulletin: Vulnerability in bleach bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the bleach library, which is affected by a improper input validation vulnerability. CVE-2025-0938. Vulnerability Details CVEID:CVE-2025-0938 DESCRIPTION: The Python standard library functions urllib.parse.urlsplit and...

Astra Linux – Vulnerability in python-bleach

A mutation XSS affects users who call bleachclean with any of the following tags: svg or math within the allowed tags p or br in allowed tags, style, title, noscript, script, textarea, noframes, iframe, or xmp within allowed tags. The keyword argument is stripcomments=False. Note: None of the abo...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-bleach (UTSA-2026-093655)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093655 advisory. A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea,...

Exploit for Cross-site Scripting in Mozilla Bleach

No d...

python313-bleach-6.4.0-1.1 on GA media (moderate)

python313-bleach-6.4.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11323-1 Rating: moderate Cross-References: CVE-2018-7753 CVE-2020-6802 CVE-2020-6816 CVE-2020-6817 CVE-2021-23980 CVSS scores: CVE-2021-23980 SUSE : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUS...

PT-2026-63453

These are all security issues fixed in the python313-bleach-6.4.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11323-1 python313-bleach-6.4.0-1.1 on GA media

These are all security issues fixed in the python313-bleach-6.4.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-59923

A flaw was found in Mistune, a Python Markdown parser. This vulnerability allows an attacker to bypass URL protections by using specially crafted Markdown links or images containing percent-encoded javascript URIs. This can lead to the execution of arbitrary scripts in the rendered HTML,...

GHSA-GJ48-438W-JH9V Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes

Summary Bleach clean / Cleaner fails to sanitize dangerous URI schemes in allowed formaction attributes. Bleach applies URI protocol sanitization only to attributes listed in attrvalisuri. While URI-bearing attributes such as action, href, src, and poster are included in that set, formaction is...

tinyblog (>=0.3.0, <=0.5.2) potentially affected by unknown CVE via bleach (1.2.2)

bleach PYPI version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - tinyblog =0.3.0, =0.5.2 Source cves: unknown CVE Source advisory: OSV:GHSA-GJ48-438W-JH9V...

asc (>=0.1.0, <=0.3.1), cloudml-hackathon-tensorboard (>=0.1.3, <=1.0.0) +19 more potentially affected by unknown CVE via bleach (1.5.0)

bleach PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - asc =0.1.0, =0.1.3, =0.2.1, =0.0.1, =0.1.0, =1.1.0, =4.0.2, =0.6.12a2, =0.1.1.1, =0.0.0.dev1, =2.1.0b3, =2.0.1, =0.4.0a0, =1.6.0rc0, =1.8.0 and more...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by unknown CVE via bleach (2.0.0)

bleach PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-GJ48-438W-JH9V...

protobuf-compiler (1.0.20) potentially affected by unknown CVE via bleach (2.1.0)

bleach PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - protobuf-compiler 1.0.20 Source cves: unknown CVE Source advisory: OSV:GHSA-GJ48-438W-JH9V...

alo7-airflow (>=1.10.0, <=1.10.0.7), cateye (>=0.3.4, <=0.3.6) potentially affected by unknown CVE via bleach (2.1.2)

bleach PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - alo7-airflow =1.10.0, =0.3.4, =0.3.6 Source cves: unknown CVE Source advisory: OSV:GHSA-GJ48-438W-JH9V...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by unknown CVE via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: unknown CVE Source advisory: OSV:GHSA-GJ48-438W-JH9V...

django-crispy-contact-form (>=0.3.6, <=0.3.8), multidocs (0.1.1) +9 more potentially affected by unknown CVE via bleach (2.1.4)

bleach PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - django-crispy-contact-form =0.3.6, =2.2.0, =2.0.0, =0.5.0a2.post1, =0.4.0a5, =0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-GJ48-438W-JH9...

hellobluenove (2.0.0) potentially affected by unknown CVE via bleach (3.0.1)

bleach PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - hellobluenove 2.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-GJ48-438W-JH9V...

ip2geotools (0.1.4), pagarme-surfmappers (>=1.3.3, <=1.4.0) +2 more potentially affected by unknown CVE via bleach (3.0.2)

bleach PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - ip2geotools 0.1.4 - pagarme-surfmappers =1.3.3, =0.1.3, =0.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-GJ48-438W-JH9V...

adversarial-labeller (0.1.8), autodiffing (>=0.0.6, <=0.0.7) +60 more potentially affected by unknown CVE via bleach (3.1.0)

bleach PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - adversarial-labeller 0.1.8 - autodiffing =0.0.6, =0.3.0, =0.0.5, =0.0.1, =1.0.2, =0.1.2, =1.0.1.0, =1.0.2.0, =1.0.1.0, =1.0.27.0 - ecs-crd-cli 1.2.0...