GHSA-GJ48-438W-JH9V: Client-Side HTML Sanitization Bypass in Bleach

Vulnerability ID: GHSA-GJ48-438W-JH9V
CVSS Score: 6.1
Published: 2026-06-16

A client-side HTML sanitization bypass vulnerability exists in the Bleach library where the formaction attribute is not recognized as a URI. This allows attackers to inject javascript: URIs when formaction is on the allowed list, resulting in Cross-Site Scripting (XSS).

TL;DR

Bleach fails to sanitize the formaction attribute, permitting submit-triggered XSS when explicitly allowed in configurations.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network (AV:N)
• CVSS Score: 6.1
• Impact: Client-Side Code Execution (XSS)
• Exploit Status: PoC
• KEV Status: Not Listed

Affected Systems

• Bleach (PyPI Package)
• bleach: < 6.4.0 (Fixed in: 6.4.0)

Mitigation Strategies

• Upgrade Bleach to version 6.4.0 or newer.
• Do not explicitly allow the formaction attribute in configurations.
• Migrate to supported HTML sanitizers such as nh3.

Remediation Steps:

1. Identify all occurrences of bleach.clean() and bleach.Cleaner() in the codebase.
2. Audit custom whitelists to ensure the formaction attribute is not permitted.
3. Execute pip install --upgrade bleach to update the package to 6.4.0.
4. Evaluate and implement migration of the codebase to nh3 or another actively maintained sanitization library.

References

• Official GitHub Security Advisory
• Mozilla Bleach GitHub Repository
• Mozilla Bleach v6.4.0 Release Page
• Mozilla Bleach Deprecation Statement
• GitHub Advisory Database Catalog Link

Read the full report for GHSA-GJ48-438W-JH9V on our website for more details including interactive diagrams and full exploit analysis.