CVE-2020-6816

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Mozilla Bleach	<=3.11

References

https://advisory.checkmarx.net/advisory/CX-2020-4277Exploit, Third Party Advisory
https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5/
https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleachExploit, Third Party Advisory
https://advisory.checkmarx.net/advisory/CX-2020-4277Exploit, Third Party Advisory
https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5/
https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleachExploit, Third Party Advisory

Timeline

Published: Mar 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-68177.5bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an CVE-2020-68198.1Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted atta CVE-2020-68208.1Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in t CVE-2020-68217.5When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification r CVE-2020-68228.8On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is CVE-2020-68239.8A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promi CVE-2020-68242.8Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Fi CVE-2020-68259.8Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR CVE-2020-68269.8Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed CVE-2020-68274.7When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into dis CVE-2020-68287.5A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file CVE-2020-68295.3When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the