CVE-2024-34078 html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization
An attacker can inject arbitrary HTML via unicode normalization bypass in the html-sanitizer library, potentially leading to XSS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-34078?
CVE-2024-34078 is a medium-severity cross-site scripting vulnerability in matthiask html-sanitizer, published on 6 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.
Weakness: CWE-79
Which versions are affected by CVE-2024-34078?
3 open source packages ship an affected version, including html-sanitizer.
| Package | Affected | Fixed in |
|---|---|---|
html-sanitizer PyPI | All versions | 2.4.2 |
html-sanitizer PyPI | All versions | 2.4.2 |
html-sanitizer PyPI | All versions | 2.4.2 |
How do I fix CVE-2024-34078?
Upgrade html-sanitizer to 2.4.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-34078 being exploited?
There is no known exploitation of CVE-2024-34078 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-34078, DLA-3856-1, GHSA-wvhx-q427-fgh3, PYSEC-2026-1455, UBUNTU-CVE-2024-34078.