CVE-2021-42576: Input Validation
First published: Mon Oct 18 2021(Updated: )
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microco Bluemonday | <1.0.16 | |
| Python Pybluemonday | <0.0.8 | |
| go/github.com/microcosm-cc/bluemonday | <1.0.16 | 1.0.16 |
| pip/pybluemonday | <0.0.8 | 0.0.8 |
| <1.0.16 | ||
| <0.0.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/
- https://nvd.nist.gov/vuln/detail/CVE-2021-42576
- https://github.com/microcosm-cc/bluemonday/commit/c788a2a4d42e081ad54a31368478820bb4a42fb4
- https://pkg.go.dev/vuln/GO-2022-0588
- https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50
- https://github.com/advisories/GHSA-x95h-979x-cf3j (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/pybluemonday/PYSEC-2021-849.yaml
- https://pypi.org/project/pybluemonday
Frequently Asked Questions
What is CVE-2021-42576?
CVE-2021-42576 is a vulnerability in the bluemonday sanitizer before 1.0.16 for Go and before 0.0.8 for Python (in pybluemonday) that does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
How severe is CVE-2021-42576?
CVE-2021-42576 has a severity rating of 9.8, which is considered critical.
What software versions are affected by CVE-2021-42576?
The bluemonday sanitizer before 1.0.16 for Go and before 0.0.8 for Python (in pybluemonday) are affected by CVE-2021-42576.
How can I fix CVE-2021-42576?
To fix CVE-2021-42576, you should update your bluemonday sanitizer to version 1.0.16 for Go or version 0.0.8 for Python (in pybluemonday) or later.
Where can I find more information about CVE-2021-42576?
You can find more information about CVE-2021-42576 at the following reference: https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/
- collector/nvd-index
- agent/type
- agent/weakness
- agent/description
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-x95h-979x-cf3j
- alias/CVE-2021-42576
- agent/references
- agent/severity
- collector/github-advisory
- collector/nvd-api
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- vendor/microco
- canonical/microco bluemonday
- vendor/python
- canonical/python pybluemonday
- package-manager/go
- package-manager/pip