CVE-2021-29272

CVE-2021-29272 affects bluemonday < 1.0.5, where a Go lowercasing bug with Cyrillic uppercase characters defeats a protection against the string "[removed]" and enables XSS. Affected component is the bluemonday HTML sanitizer (Go library). Root cause: improper normalization allowing Cyrillic u...

CVE-2021-42576

CVE-2021-42576 affects the bluemonday HTML sanitizer. The issue is that policies for the STYLE, SELECT and OPTION elements are not properly enforced in bluemonday before versions 1.0.16 (Go) and 0.0.8 (Python/pybluemonday). Root cause: policy enforcement gaps allow disallowed styling to leak into...