Cross-site scripting in Bleach - #VU133466
Published: June 8, 2026
Vulnerability identifier: #VU133466
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Mozilla
Affected software:
Bleach
Bleach
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in Bleach clean() / Cleaner() sanitization of allowed formaction attributes when sanitizing untrusted HTML that includes submit-capable controls with allowed formaction attributes. A remote attacker can supply crafted HTML containing a dangerous javascript: URI in a formaction attribute to execute arbitrary script in the victim's browser.
User interaction is required to activate the affected submit control, and only configurations that explicitly allow the relevant tag and attribute combination are vulnerable.
Remediation
Install security update from vendor's website.