Cross-Site Scripting (XSS)

bleach is vulnerable to cross-site scripting XSS. Invocation of bleach.clean method with a scripting parameter set to FALSE and a raw tags such as title, textarea, script, style, noembed, noframes, iframe, xmp allows BleachHTMLParser to process user-contributed content using innerHTML property,...