https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T06:12:04.211838+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2021-03144 bdu:2021-03144 2026-10-04T06:12:04.640184+00:00 bdu:2021-03144 https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2021-23980 BREW-jupyterlab-CVE-2021-23980 — Cross-site scripting in Bleach 2026-10-04T06:12:04.640245+00:00

Affected: Homebrew: jupyterlab

### Impact

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

* `svg` or `math` in the allowed tags * `p` or `br` in allowed tags * `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags * the keyword argument `strip_comments=False`

Note: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.

### Patches

Users are encouraged to upgrade to bleach v3.3.0 or greater.

Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.

### Workarounds

* modify `bleach.clean` calls to at least one of: * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag * not allow `svg` or `math` tags * not allow `p` or `br` tags * set `strip_comments=True`

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399 * https://advisory.checkmarx.net/advisory/CX-2…

 https://cve.radiocsirt.org/vuln/euvd-2026-223586 EUVD-2026-223586 2026-10-04T06:12:04.640338+00:00 EUVD-2026-223586 https://cve.radiocsirt.org/vuln/fkie_cve-2021-23980 fkie_cve-2021-23980 2026-10-04T06:12:04.640361+00:00

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

 https://cve.radiocsirt.org/vuln/ghsa-vv2x-vrpj-qqpq GHSA-vv2x-vrpj-qqpq — Cross-site scripting in Bleach 2026-10-04T06:12:04.640398+00:00

Affected: PyPI: bleach

### Impact

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

* `svg` or `math` in the allowed tags * `p` or `br` in allowed tags * `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags * the keyword argument `strip_comments=False`

Note: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.

### Patches

Users are encouraged to upgrade to bleach v3.3.0 or greater.

Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.

### Workarounds

* modify `bleach.clean` calls to at least one of: * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag * not allow `svg` or `math` tags * not allow `p` or `br` tags * set `strip_comments=True`

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399 * https://advisory.checkmarx.net/advisory/CX-2…

 https://cve.radiocsirt.org/vuln/gsd-2021-23980 gsd-2021-23980 2026-10-04T06:12:04.640483+00:00 gsd-2021-23980 https://cve.radiocsirt.org/vuln/msrc_cve-2021-23980 msrc_CVE-2021-23980 — A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags… 2026-10-04T06:12:04.640507+00:00 msrc_CVE-2021-23980 https://cve.radiocsirt.org/vuln/oesa-2022-1861 OESA-2022-1861 — python-bleach security update 2026-10-04T06:12:04.640535+00:00

Affected: openEuler:22.03-LTS: python-bleach

Bleach is an HTML sanitizing library that escapes or strips markup and attributes based on a white list. Security Fix(es): No description is available for this CVE.(CVE-2021-23980)

 https://cve.radiocsirt.org/vuln/opensuse-su-2021:0552-1 openSUSE-SU-2021:0552-1 — Security update for python-bleach 2026-10-04T06:12:04.640568+00:00

Security update for python-bleach

 https://cve.radiocsirt.org/vuln/pysec-2021-865 PYSEC-2021-865 2026-10-04T06:12:04.640597+00:00

Affected: PyPI: bleach

In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, script, textarea, noframes, iframe, or xmp tags with strip_comments=False.

 https://cve.radiocsirt.org/vuln/rhsa-2021:0781 RHSA-2021:0781 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 1.2.2 security and bug fix update 2026-10-04T06:12:04.640626+00:00

nodejs-node-notifier: command injection due to the options params not being sanitised when being passed an array nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function django: Potential directory-traversal via archive.extract() python-pygments: Infinite loop in SML lexer may lead to DoS python-bleach: Mutation cross-site scripting in bleach.clean python-pygments: ReDoS in multiple lexers

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-23980 UBUNTU-CVE-2021-23980 2026-10-04T06:12:04.640664+00:00

Affected: Ubuntu:Pro:16.04:LTS: python-bleach, Ubuntu:Pro:18.04:LTS: python-bleach, Ubuntu:Pro:20.04:LTS: python-bleach

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.