Vulnerabilities for bleach

First version without a known vulnerability: 6.4.0

Details

• GHSA-gj48-438w-jh9v2026-06-16

  Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes

  Fixed in: 6.4.0

• GHSA-g75f-g53v-794x2026-06-16

  Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning

• GHSA-8rfp-98v4-mmr62026-06-16

  Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output

  Fixed in: 6.4.0

• GHSA-vv2x-vrpj-qqpq2021-02-02

  Cross-site scripting in Bleach

  Fixed in: 3.3.0, 79b7a3c5e56a09d1d323a5006afa59b56162eb13

• GHSA-vqhp-cxgc-6wmm2020-03-30

  regular expression denial-of-service (ReDoS) in Bleach

  Fixed in: 3.1.4

• GHSA-m6xf-fq7q-87432020-03-24

  Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag

  Fixed in: 3.1.2

• GHSA-q65m-pv3f-wr5r2020-02-24

  XSS in Bleach when noscript and raw tag whitelisted

  Fixed in: 3.1.1

• GHSA-m9mq-p2f9-cfqv2019-01-04

  Bleach URI Scheme Restriction Bypass

  Fixed in: 2.1.3, c5df5789ec3471a31311f42c2d19fc2cf21b35ef