CVE-2021-23980

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-239818.1A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memo CVE-2021-239826.5Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as s CVE-2021-239836.5By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memo CVE-2021-239846.5A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be f CVE-2021-239856.5If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debug CVE-2021-239866.5A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The CVE-2021-239878.8Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed e CVE-2021-239888.8Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume CVE-2021-23994.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prio CVE-2021-239916.8If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's update CVE-2021-239924.3Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version CVE-2021-239936.5An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted Ope