CVE-2021-42576

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-42576
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-42576.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-42576
Aliases
Downstream
Published
2021-10-18T15:15:07.823Z
Modified
2026-03-13T05:12:48.455543Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

References

Affected packages

Git / github.com/microcosm-cc/bluemonday

Affected ranges

Type
GIT
Repo
https://github.com/microcosm-cc/bluemonday
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c788a2a4d42e081ad54a31368478820bb4a42fb4
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.16"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "0.0.8"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-42576.json"