CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-42576
Critical (9.8). EPSS 1.6% chance of exploitation in the next 30 days. Fixed in pybluemonday 0.0.8.
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Severity
- EPSS
- 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- microco:bluemonday
- python:pybluemonday
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x95h-979x-cf3j | PyPI | pybluemonday | <0.0.8 | 0.0.8 |
| GHSA-x95h-979x-cf3j | Go | github.com/microcosm-cc/bluemonday | <1.0.16 | 1.0.16 |
| GO-2022-0588 | Go | github.com/microcosm-cc/bluemonday | <1.0.16 | 1.0.16 |
| PYSEC-2021-849 | PyPI | pybluemonday | <0.0.8 | 0.0.8 |