Microco Bluemonday vulnerabilities

2 vulnerabilities

Known vulnerabilities in Microco Bluemonday, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CVE-2021-42576debiangolang-github-microcosm-cc-bluemonday+5
EPSS score
1.56%
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.6.1CVE-2021-29272ubuntugolang-github-microcosm-cc-bluemonday+2
EPSS score
0.93%
bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.