{"id":"GHSA-wvhx-q427-fgh3","summary":"Arbitrary HTML present after sanitization because of unicode normalization","details":"### Impact\n\nIf using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization.\n\n### Patches\n\nThe problem has been fixed in 2.4.2.\n\n### Workarounds\n\nSet `keep_typographic_whitespace=True` explicitly, or normalize to NFKC yourself earlier.\n","aliases":["CVE-2024-34078","PYSEC-2026-1455"],"modified":"2026-07-07T17:56:25.704027949Z","published":"2024-05-06T14:33:32Z","related":["CVE-2024-34078"],"database_specific":{"cwe_ids":[],"github_reviewed_at":"2024-05-06T14:33:32Z","github_reviewed":true,"nvd_published_at":null,"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3"},{"type":"WEB","url":"https://github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550"},{"type":"PACKAGE","url":"https://github.com/matthiask/html-sanitizer"}],"affected":[{"package":{"name":"html-sanitizer","ecosystem":"PyPI","purl":"pkg:pypi/html-sanitizer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2"}]}],"versions":["1.0.0","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.2.0","1.2.1","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.7.0","1.7.1","1.7.2","1.7.3","1.8.0","1.9.0","1.9.1","1.9.2","1.9.3","2.0.0","2.1.0","2.2.0","2.3.0","2.3.1","2.4.0","2.4.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-wvhx-q427-fgh3/GHSA-wvhx-q427-fgh3.json"}}],"schema_version":"1.7.3"}