CVE-2018-7753: Bleach - Improper URI Sanitization
Summary
CVE-2018-7753: An issue was discovered in Bleach 2.1.x before 2.1.3. Affects bleach across 2 version ranges.
>= 2.1, < 2.1.3
< c5df5789ec3471a31311f42c2d19fc2cf21b35ef
Fixed in c5df5789ec3471a31311f42c2d19fc2cf21b35ef. How to fix ↓
Also tracked for
- python-bleach · Debian:11
The same CVE-2018-7753 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Bleach is a Python package available on PyPI that provides a simple way to sanitize and linkify text. It is commonly used to prevent Cross-Site Scripting (XSS) attacks by sanitizing user-generated content. However, versions 2.1.x before 2.1.3 of Bleach had a vulnerability related to URI value sanitization. When character entities were used in URI values, the sanitization process failed to properly handle them. This allowed an attacker to construct a URI value with an unauthorized scheme that would bypass the sanitization process.
Vulnerability Detail
The vulnerability in Bleach allowed an attacker to bypass the URI sanitization process by using character entities in URI values. By crafting a URI value with an unauthorized scheme, an attacker could potentially execute malicious actions, such as redirecting users to malicious websites or performing other unauthorized operations. This vulnerability could lead to Cross-Site Scripting (XSS) attacks or other security breaches.
How To Fix
Latest published version: 6.4.0 as of 22 Oct 2026
pip install --upgrade "bleach==6.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
c5df5789ec3471a31311f42c2d19fc2cf21b35ef
This is the first release that contains the fix.
pip install --upgrade "bleach==c5df5789ec3471a31311f42c2d19fc2cf21b35ef"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Bleach (CVE-2018-7753) allowed an attacker to bypass URI sanitization by using character entities in URI values. This could lead to potential security breaches, such as Cross-Site Scripting (XSS) attacks. To mitigate this vulnerability, it is recommended to upgrade Bleach to version 2.1.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bleach →
FAQ
This vulnerability could allow an attacker to bypass URI sanitization and potentially execute malicious actions, such as redirecting users to malicious websites or performing unauthorized operations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to the fixed version of Bleach (2.1.3 or later).
There are no known exploits mentioned for this vulnerability. However, it is important to promptly upgrade to the fixed version to mitigate any potential risks.
You can find more information about this vulnerability in the Bleach advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/bleach/PYSEC-2018-51.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for bleach.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
