CVE-2020-6816: Bleach - Mutation XSS via Whitelisted Math or SVG and Raw Tag
Summary
CVE-2020-6816: Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag. Affects bleach versions < 3.1.2. Fixed in 3.1.2. How to fix ↓
Also tracked for
- python-bleach · Debian:11
The same CVE-2020-6816 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bleach is an open-source Python library that provides a simple way to sanitize and clean user-generated HTML. It is commonly used to prevent cross-site scripting (XSS) attacks by removing potentially dangerous HTML tags and attributes. Bleach allows users to specify a whitelist of allowed tags and attributes, ensuring that only safe HTML is rendered. However, a vulnerability in Bleach versions prior to 3.1.2 allows for mutation XSS attacks when certain conditions are met.
Vulnerability Detail
The vulnerability, known as mutation XSS, affects users who call the bleach.clean function with the following conditions: the svg or math tags are whitelisted, an RCDATA tag is whitelisted, and the strip parameter is set to False. In this scenario, an attacker can inject malicious code that will be executed by the browser. This type of attack can lead to various consequences, including the theft of sensitive information, session hijacking, or the spread of malware.
How To Fix
Latest published version: 6.4.0 as of 22 Oct 2026
pip install --upgrade "bleach==6.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.2
This is the first release that contains the fix.
pip install --upgrade "bleach==3.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, there are a couple of workarounds available. One option is to modify the bleach.clean calls to use strip=True instead of strip=False. Alternatively, users can choose not to whitelist the math or svg tags and include one or more of the following tags in the whitelist: script, noscript, style, noframes, xmp, noembed, or iframe. Additionally, implementing a strong Content-Security-Policy (CSP) without unsafe-inline and unsafe-eval for script-src can help mitigate the risk.
Conclusion
The mutation XSS vulnerability in Bleach versions prior to 3.1.2 can be exploited by attackers to execute malicious code in the victim's browser. Upgrading to the latest version of Bleach is the recommended solution, as it includes patches to address this vulnerability. If immediate upgrade is not possible, there are workarounds available, such as modifying the bleach.clean calls or implementing a strong Content-Security-Policy. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for bleach →
FAQ
Mutation XSS is a type of cross-site scripting attack where the attacker injects malicious code that modifies the existing HTML structure of a page. This allows the attacker to bypass traditional XSS filters and execute their code.
The impact of this vulnerability can be severe. An attacker could exploit it to execute arbitrary code in the context of the victim's browser, potentially leading to data theft, session hijacking, or the spread of malware.
To fix this vulnerability, it is recommended to upgrade to Bleach version 3.1.2 or later. This update includes patches that address the mutation XSS issue.
Yes, if upgrading immediately is not possible, there are workarounds. One option is to modify the bleach.clean calls to use strip=True instead of strip=False. Another option is to exclude the math or svg tags from the whitelist and include additional tags like script, noscript, style, noframes, xmp, noembed, or iframe. Implementing a strong Content-Security-Policy (CSP) without unsafe-inline and unsafe-eval for script-src can also help mitigate the risk.
For more information, you can visit the official GitHub repository of Bleach at https://github.com/mozilla/bleach/issues. You can also email security@mozilla.org for any questions or comments.
Related vulnerabilities
Recent vulnerabilities recorded for bleach.
