PT-2020-2103 · Mozilla+3 · Bleach+3

Yaniv Nizry · Published 2020-03-20 · Updated 2026-03-05 · CVE-2020-6816

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Bleach versions prior to 3.12

Description A mutation XSS issue affects users calling bleach.clean with specific settings, including whitelisting svg or math tags, allowing RCDATA tags, and setting the strip keyword argument to False. This could potentially allow a remote attacker to impact data integrity.

Recommendations For versions prior to 3.1.2: Upgrade to bleach v3.1.2 or greater. As a temporary workaround, consider modifying bleach.clean calls to use strip=True, or not whitelisting math or svg tags and one or more of the following tags: script, noscript, style, noframes, xmp, noembed, iframe. Implementing a strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs will also help mitigate the risk.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-01964

CVE-2020-6816

DSA-4643-1

GHSA-M6XF-FQ7Q-8743

MGASA-2020-0176

OPENSUSE-SU-2021:0552-1

OPENSUSE-SU-2021:0571-1

OPENSUSE-SU-2021_0552-1

OPENSUSE-SU-2024:11219-1

OPENSUSE-SU-2024:14134-1

PYSEC-2020-28

USN-8077-1

Affected Products

Bleach

Linuxmint

Suse

Ubuntu

References · 47

• 🔥 https://checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach · Exploit
• 🔥 https://advisory.checkmarx.net/advisory/CX-2020-4277 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2021:0552-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6817 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6816 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-6816 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-6816 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0571-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0176 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-28 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4643-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7753 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8077-1 · Vendor Advisory