CVE-2020-6802

Name of the Vulnerable Software and Affected Versions Mozilla Bleach versions prior to 3.11

Description The issue exists due to inadequate protection of web page structure. Exploitation can allow a remote attacker to conduct a cross-site scripting (XSS) attack. A mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.

Recommendations For versions prior to 3.11, modify bleach.clean calls to not whitelist noscript and one or more of the following raw tags: title, textarea, script, style, noembed, noframes, iframe, xmp. Implement a strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs to help mitigate the risk. Update to version 3.1.1 or later to resolve the issue.