CVE-2020-6802: XSS in Bleach when noscript and raw tag whitelisted
Summary
CVE-2020-6802: XSS in Bleach when noscript and raw tag whitelisted. Affects bleach versions < 3.1.1. Fixed in 3.1.1. How to fix ↓
Also tracked for
- python-bleach · Debian:11
The same CVE-2020-6802 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bleach is an open-source Python library that sanitizes and cleans HTML input to prevent cross-site scripting (XSS) attacks. It provides a set of functions to remove potentially dangerous tags and attributes from user-generated content. By doing so, Bleach helps protect web applications from malicious code injection.
Vulnerability Detail
This vulnerability, identified as CVE-2020-6802, is a mutation XSS (cross-site scripting) that affects users calling the bleach.clean function with noscript and a raw tag whitelisted. An attacker can exploit this vulnerability by injecting malicious code into the allowed tags, which will be executed when the sanitized HTML is rendered by the browser. The impact of this vulnerability can range from stealing sensitive user information to performing unauthorized actions on behalf of the user.
How To Fix
Latest published version: 6.4.0 as of 22 Oct 2026
pip install --upgrade "bleach==6.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.1
This is the first release that contains the fix.
pip install --upgrade "bleach==3.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the Bleach library is not immediately feasible, a temporary workaround is to modify the bleach.clean calls to exclude whitelisting of noscript and any of the following raw tags: title, textarea, script, style, noembed, noframes, iframe, xmp. By removing these tags from the allowed list, the risk of exploitation can be mitigated. Additionally, implementing a strong Content-Security-Policy (CSP) without unsafe-inline and unsafe-eval in the script-src directive can provide an extra layer of protection.
Conclusion
The vulnerability CVE-2020-6802 in Bleach exposes web applications to cross-site scripting attacks. It is crucial to update the Bleach library to version 3.1.1 or later to mitigate the risk. If immediate update is not possible, applying the mentioned workarounds and implementing a strong Content-Security-Policy can help protect against exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bleach →
FAQ
Bleach is a Python library used for sanitizing and cleaning HTML input to prevent cross-site scripting (XSS) attacks. It helps protect web applications from malicious code injection.
Mutation XSS is a type of cross-site scripting attack where the attacker injects malicious code into the allowed tags, which is then executed when the sanitized HTML is rendered by the browser.
An attacker can exploit this vulnerability by injecting malicious code into the allowed tags, such as noscript and raw tags, which will be executed when the sanitized HTML is rendered by the browser. This can lead to unauthorized actions or theft of sensitive user information.
To fix this vulnerability, update the Bleach library to version 3.1.1 or later. This update includes a patch that addresses the XSS vulnerability.
If updating the Bleach library is not immediately feasible, a temporary workaround is to modify the bleach.clean calls to exclude whitelisting of noscript and any of the following raw tags: title, textarea, script, style, noembed, noframes, iframe, xmp. Additionally, implementing a strong Content-Security-Policy (CSP) without unsafe-inline and unsafe-eval in the script-src directive can provide an extra layer of protection.
References
Related vulnerabilities
Recent vulnerabilities recorded for bleach.
