Vulnerability Database

359,359

Total vulnerabilities in the database

Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes — bleach

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary

Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes.

Bleach applies URI protocol sanitization only to attributes listed in attr_val_is_uri. While URI-bearing attributes such as action, href, src, and poster are included in that set, formaction is not. As a result, if a downstream application explicitly allows formaction on submit-capable controls in untrusted HTML, Bleach preserves dangerous values such as javascript:alert(1) instead of stripping them.

This can lead to submit-triggered JavaScript execution in applications that rely on Bleach to sanitize untrusted HTML and allow the relevant tag/attribute combination.

Details

The issue appears to be a URI-sanitization coverage gap in Bleach’s sanitizer logic.

Relevant code paths:

  • bleach/sanitizer.py — BleachSanitizerFilter.allow_token (around line 553)
  • bleach/_vendor/html5lib/filters/sanitizer.py — attr_val_is_uri (around line 525)

In BleachSanitizerFilter.allow_token, URI protocol sanitization is only applied when:

if namespaced_name in self.attr_val_is_uri:

However, (None, 'formaction') is currently missing from attr_val_is_uri.

This creates an inconsistency where action is protocol-sanitized, but formaction is not.

As a result, if a downstream application allows:

  • tags such as <button> or <input>
  • the formaction attribute

then Bleach preserves dangerous URI schemes such as javascript: in formaction.

Examples of affected submit-capable controls include:

  • <button> (default submit behavior unless type="button" is set)
  • <input type="submit">
  • <input type="image">

This appears to be a real library-side sanitizer gap rather than only an application misuse issue, because Bleach already treats similar URI-bearing attributes (such as action) as protocol-sensitive and sanitizes them.

Suggested minimal fix:

Add:

(None, 'formaction')

to attr_val_is_uri in:

  • bleach/_vendor/html5lib/filters/sanitizer.py

I also prepared a minimal patch and focused regression tests if helpful.

PoC

Below are minimal reproductions using bleach.clean().

1) <button>

from bleach import clean print(clean( '<form><button formaction="javascript:alert(1)">go</button></form>', tags={'form', 'button'}, attributes={'button': ['formaction']}, ))

Actual output:

<form><button formaction="javascript:alert(1)">go</button></form>

Expected output:

<form><button>go</button></form>

2) <input type="submit">

print(clean( '<form><input type="submit" formaction="javascript:alert(1)" value="go"></form>', tags={'form', 'input'}, attributes={'input': ['type', 'formaction', 'value']}, ))

Actual output:

<form><input type="submit" formaction="javascript:alert(1)" value="go"></form>

Expected output:

<form><input type="submit" value="go"></form>

3) <input type="image">

print(clean( '<form><input type="image" formaction="javascript:alert(1)" src="/foo.png"></form>', tags={'form', 'input'}, attributes={'input': ['type', 'formaction', 'src']}, ))

Actual output:

<form><input type="image" formaction="javascript:alert(1)" src="/foo.png"></form>

Expected output:

<form><input type="image" src="/foo.png"></form>

Impact

This is a client-side HTML sanitization bypass / dangerous URI preservation issue.

If an application relies on Bleach to sanitize untrusted HTML and explicitly allows:

  • formaction
  • and submit-capable controls such as <button> or <input>

then Bleach can emit sanitized output that still contains a dangerous javascript: URI in formaction.

That can lead to submit-triggered JavaScript execution when the user activates the control.

Impact is limited to configurations that explicitly allow the relevant tag/attribute combination, but the issue is still security-relevant because:

  • formaction is a real browser sink
  • Bleach already protocol-sanitizes similar URI-bearing attributes like action
  • the omission creates inconsistent sanitizer coverage for dangerous URI schemes

I would currently assess this as Medium severity.

If useful, I also have:

  • a minimal patch

  • focused regression tests for:

    • <button formaction="javascript:...">
    • <input type="submit" formaction="javascript:...">
    • <input type="image" formaction="javascript:...">
    • a safe control case where formaction="/submit" is preserved
  • Published: Jun 16, 2026
  • Updated: Jun 17, 2026
  • GHSA: GHSA-gj48-438w-jh9v
  • Severity: Medium
  • Exploit:
  • CISA KEV:

CVSS v3:

  • Severity: Medium
  • Score: 6.1
  • AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
Python icon bleach - 6.4.0

Frequently Asked Questions

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.