CVE-2020-6816

Name of the Vulnerable Software and Affected Versions Mozilla Bleach versions prior to 3.12

Description A mutation XSS issue affects users calling bleach.clean with specific settings, including whitelisting svg or math tags, allowing RCDATA tags, and setting the strip keyword argument to False. This could potentially allow a remote attacker to impact data integrity.

Recommendations For versions prior to 3.1.2: Upgrade to bleach v3.1.2 or greater. As a temporary workaround, consider modifying bleach.clean calls to use strip=True, or not whitelisting math or svg tags and one or more of the following tags: script, noscript, style, noframes, xmp, noembed, iframe. Implementing a strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs will also help mitigate the risk.