Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-wvhx-q427-fgh3

Опубликовано: 06 мая 2024
Источник: github
Github: Прошло ревью

Описание

Arbitrary HTML present after sanitization because of unicode normalization

Impact

If using keep_typographic_whitespace=False (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization.

Patches

The problem has been fixed in 2.4.2.

Workarounds

Set keep_typographic_whitespace=True explicitly, or normalize to NFKC yourself earlier.

Пакеты

Наименование

html-sanitizer

pip
Затронутые версииВерсия исправления

< 2.4.2

2.4.2

EPSS

Процентиль: 36%
0.00151
Низкий

Связанные уязвимости

CVSS3: 6.1
ubuntu
почти 2 года назад

html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.

CVSS3: 6.1
nvd
почти 2 года назад

html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.

CVSS3: 6.1
debian
почти 2 года назад

html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typo ...

EPSS

Процентиль: 36%
0.00151
Низкий