GHSA-x95h-979x-cf3j

Policies not properly enforced in bluemonday

Source: GitHub Advisory Database (reviewed) High CVE-2021-42576

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pybluemonday	< 0.0.8	0.0.8
Go	github.com/microcosm-cc/bluemonday	< 1.0.16	1.0.16

Details

As written in the advisory (Markdown source, shown as plain text).

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-42576 advisory
https://github.com/microcosm-cc/bluemonday/commit/c788a2a4d42e081ad54a31368478820bb4a42fb4 web
https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50 web
https://github.com/advisories/GHSA-x95h-979x-cf3j advisory
https://github.com/microcosm-cc/bluemonday package
https://github.com/pypa/advisory-database/tree/main/vulns/pybluemonday/PYSEC-2021-849.yaml web
https://pkg.go.dev/vuln/GO-2022-0588 web
https://pypi.org/project/pybluemonday web