Homepage
About Snyk

bleach@0.3.0 vulnerabilities

A minimalistic HTML sanitizer

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the bleach package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Regular Expression Denial of Service (ReDoS)

bleach 3.0 and earlier is vulnerable to Regular expression Denial of Service (ReDoS) when certain types of input are passed into the sanitize function.

bleach performs html sanitization, which has definite value from a security perspective. However, it does not control the length of the html it processes, and uses regular expressions to parse it. As a result, it is susceptible to a Regular expression Denial of Service (ReDoS) vulnerabilities, rendering an application unavailable if a long or complex input is passed in.

*
Go back to all versions of this package