CVE-2024-34078

html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...

PT-2024-25688 · Unknown · Sanitize-Html

Name of the Vulnerable Software and Affected Versions: html-sanitizer versions prior to 2.4.2 Description: The issue concerns an allowlist-based HTML cleaner. If using keep typographic whitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicod...