CVE-2024-34078: Arbitrary HTML present after sanitization because of unicode normalization

May 6, 2024

If using keep_typographic_whitespace=False (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization.

References

github.com/advisories/GHSA-wvhx-q427-fgh3
github.com/matthiask/html-sanitizer
github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550
github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3
nvd.nist.gov/vuln/detail/CVE-2024-34078

Code Behaviors & Features

Detect and mitigate CVE-2024-34078 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →