{"id":"PYSEC-2026-1455","summary":"Arbitrary HTML present after sanitization because of unicode normalization","details":"### Impact\n\nIf using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization.\n\n### Patches\n\nThe problem has been fixed in 2.4.2.\n\n### Workarounds\n\nSet `keep_typographic_whitespace=True` explicitly, or normalize to NFKC yourself earlier.\n","aliases":["CVE-2024-34078","GHSA-wvhx-q427-fgh3"],"modified":"2026-07-07T17:47:44.646585963Z","published":"2026-07-07T11:45:42.091141Z","references":[{"type":"WEB","url":"https://github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3"},{"type":"WEB","url":"https://github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550"},{"type":"PACKAGE","url":"https://github.com/matthiask/html-sanitizer"},{"type":"PACKAGE","url":"https://pypi.org/project/html-sanitizer"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wvhx-q427-fgh3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34078"}],"affected":[{"package":{"name":"html-sanitizer","ecosystem":"PyPI","purl":"pkg:pypi/html-sanitizer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2"}]}],"versions":["1.0.0","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.2.0","1.2.1","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.7.0","1.7.1","1.7.2","1.7.3","1.8.0","1.9.0","1.9.1","1.9.2","1.9.3","2.0.0","2.1.0","2.2.0","2.3.0","2.3.1","2.4.0","2.4.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/html-sanitizer/PYSEC-2026-1455.yaml"}}],"schema_version":"1.7.5"}