Back to Database
Status published
Medium
CVE-2024-34078
html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization
Vulnerability Description
html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-34078
Credits & Attribution
No credits recorded in the NVD database.
Affected Vendor
matthiask
View all reports →Affected Software
html-sanitizer
Vulnerable Versions:
< 2.4.2
Timeline
Official Publish:
May 6th, 2024
Last Modified:
August 26th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N