CVE-2024-34078: html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-06 · updated 2026-06-17
Weakness: CWE-79

Description

html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.

Affected products

matthiask html-sanitizer: before 2.4.2

References

https://github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550
https://github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3
https://github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550
https://github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3
https://lists.debian.org/debian-lts-announce/2024/08/msg00000.html

Get alerted when CVE-2024-34078 or the next vulnerability affects your stack