CVE-2021-23980 is a medium-severity mutation Cross-Site Scripting (XSS) vulnerability affecting the mozilla bleach library. It occurs when bleach.clean is used with specific, non-default configurations involving SVG/Math tags, P/BR tags, and certain other tags, alongside strip_comments=False. The vulnerability has a CVSS score of 6.1, indicating a network-based attack requiring user interaction, with potential for low impact on confidentiality and integrity. There is currently no evidence of active exploitation, and no public exploit code or significant community discussion has been observed.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.3.0CPE matchmatch criteria | cpe:2.3:a:mozilla:bleach:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Bleach vulnerabilities
Mar 5, 2026A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
Feb 14, 2023Cross-site scripting in Bleach
Feb 2, 2021python-bleach: Mutation cross-site scripting in bleach.clean
Feb 2, 2021