Policies not properly enforced in bluemonday

CRITICAL 9.8CVE-2021-42576 · GHSA-x95h-979x-cf3j · GO-2022-0588 · Published 18/10/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/microcosm-cc/bluemonday Go	`< 1.0.16`	`1.0.16`
pybluemonday PyPI	`< 0.0.8`	`0.0.8`
bluemonday microco	`< 1.0.16`	`1.0.16`
pybluemonday python	`< 0.0.8`	`0.0.8`

Description

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

NVD description

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

References

nvd.nist.gov/vuln/detail/CVE-2021-42576 · ADVISORY
microcosm-cc/bluemonday commit c788a2a · WEB
docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50 · WEB
GitHub Advisory GHSA-x95h-979x-cf3j · ADVISORY
microcosm-cc/bluemonday · PACKAGE
pypa/advisory-database · WEB
pkg.go.dev/vuln/GO-2022-0588 · WEB
pypi.org/project/pybluemonday · WEB
docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free