CVE-2021-42576 - The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements

Back Back to CVE browser

HIGH

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements

Published Oct 18, 2021

8.1

HIGH

CVSS 4.0

EPSS 1.56%

Description

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Affected products

pybluemonday

PyPI

Introduced 0 Fixed 0.0.8
github.com/microcosm-cc/bluemonday

Go

Introduced 0 Fixed 1.0.16

Ecosystem	Package	Introduced	Fixed
PyPI	pybluemonday	0	0.0.8
Go	github.com/microcosm-cc/bluemonday	0	1.0.16

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (7)

Link	Providers	Tags
https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50		x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-x95h-979x-cf3j		Advisory
https://github.com/microcosm-cc/bluemonday/commit/c788a2a4d42e081ad54a31368478820bb4a42fb4
https://github.com/pypa/advisory-database/tree/main/vulns/pybluemonday/PYSEC-2021-849.yaml
https://nvd.nist.gov/vuln/detail/CVE-2021-42576
https://pkg.go.dev/vuln/GO-2022-0588
https://pypi.org/project/pybluemonday