--- title: "CX-2021-4303" date: "2021-02-01T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4303/" --- # CX-2021-4303 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Feb 1, 2021 CVE-2021-23980 **Published:** Feb 1, 2021 CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 6.1 Medium Severity mozilla mxss python XSS YN Yaniv Nizry Reported by Checkmarx Zero Details Overview ## Summary Affected versions of Mozilla-bleach are vulnerable to Mutation XSS (mXSS) vulnerability when calling bleach.clean with: - `svg` or `math` allowed - `p` or `br` allowed - one of the RCDATA tags allowed: ``` script noscript style noframes xmp noembed iframe ``` - and the argument `strip_comments=False` ## Product Bleach before 3.3.0. ## Impact According to GitHub, more than 72,000 repositories are dependent on Bleach. Among them are major vendors, including multiple Fortune 500 tech companies. ## Steps to reproduce ``` >>> import bleach >>> bleach.clean('

` ## Remediation Update bleach dependency to 3.3.0 or above. ## Credit This issue was discovered and reported by Checkmarx SCA Security Researcher [Yaniv Nizry](https://www.twitter.com/ynizry). ## Resources 1. [Advisory](https://github.com/advisories/GHSA-vv2x-vrpj-qqpq) 2. Commit [79b7a3c](https://github.com/mozilla/bleach/commit/79b7a3c5e56a09d1d323a5006afa59b56162eb13) 0 Medium Severity CVSS v3.1 Score 6.1 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Disclosed Jan 28, 2021 Notified Mozilla 2. Fixed Feb 1, 2021 Fixed version v3.3.0 and an advisory on GitHub was released ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)