chore(deps): update dependency bleach to v6 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
bleach	==5.0.1 → ==6.4.0

---

Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output

GHSA-8rfp-98v4-mmr6

More information

Details

Impact

A possible XSS bypass affects users calling bleach.clean with all of:

• a in the allowed tags
• href in allowed attributes

The bleach.clean sanitizer outputs URIs containing disallowed scheme patterns that it should be stripping. However, because the inserted Unicode characters make the scheme invalid per RFC 3986, modern browsers do not execute these as javascript: URIs. The practical security impact is limited to:

• Bleach's output contains URI values that violate the caller's protocol allowlist, breaking the sanitizer's contract.
• If a downstream system performs its own Unicode normalization on bleach's output (stripping invisible characters before rendering), the javascript: scheme could become valid. This is a non-standard processing chain but represents a theoretical secondary risk.

This is not a direct XSS vulnerability.

Python code example from reporter with Bleach v6.3.0 and Python 3.13:

import bleach
payload1 = '<a href="javascript\u200b:alert(document.cookie)">Click me</a>'
result1 = bleach.clean(payload1)
print(f"(ZWSP): {repr(result1)}")

Output:

(ZWSP): '<a href="javascript\u200b:alert(document.cookie)">Click me</a>'

Patches

Users should upgrade to Bleach 6.4.0.

Workarounds

Pre-process content removing non-ASCII characters from URI schemes before sanitizing with bleach.clean.

A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs will also help mitigate the risk.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=2023812
• RFC 3986, Section 3.1 (URI Scheme syntax): scheme characters are restricted to ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )

Reported by

Reported by codeant from CodeAnt AI.

Severity

• CVSS Score: 0.0 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N

References

• https://github.com/mozilla/bleach/security/advisories/GHSA-8rfp-98v4-mmr6
• https://bugzilla.mozilla.org/show_bug.cgi?id=2023812
• https://github.com/advisories/GHSA-8rfp-98v4-mmr6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes

GHSA-gj48-438w-jh9v

More information

Details

Summary

Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes.

Bleach applies URI protocol sanitization only to attributes listed in attr_val_is_uri. While URI-bearing attributes such as action, href, src, and poster are included in that set, formaction is not. As a result, if a downstream application explicitly allows formaction on submit-capable controls in untrusted HTML, Bleach preserves dangerous values such as javascript:alert(1) instead of stripping them.

This can lead to submit-triggered JavaScript execution in applications that rely on Bleach to sanitize untrusted HTML and allow the relevant tag/attribute combination.

---

Details

The issue appears to be a URI-sanitization coverage gap in Bleach’s sanitizer logic.

Relevant code paths:

• bleach/sanitizer.py — BleachSanitizerFilter.allow_token (around line 553)
• bleach/_vendor/html5lib/filters/sanitizer.py — attr_val_is_uri (around line 525)

In BleachSanitizerFilter.allow_token, URI protocol sanitization is only applied when:

if namespaced_name in self.attr_val_is_uri:

However, (None, 'formaction') is currently missing from attr_val_is_uri.

This creates an inconsistency where action is protocol-sanitized, but formaction is not.

As a result, if a downstream application allows:

• tags such as <button> or <input>
• the formaction attribute

then Bleach preserves dangerous URI schemes such as javascript: in formaction.

Examples of affected submit-capable controls include:

• <button> (default submit behavior unless type="button" is set)
• <input type="submit">
• <input type="image">

This appears to be a real library-side sanitizer gap rather than only an application misuse issue, because Bleach already treats similar URI-bearing attributes (such as action) as protocol-sensitive and sanitizes them.

Suggested minimal fix:

Add:

(None, 'formaction')

to attr_val_is_uri in:

• bleach/_vendor/html5lib/filters/sanitizer.py

I also prepared a minimal patch and focused regression tests if helpful.

---

PoC

Below are minimal reproductions using bleach.clean().

1) <button>

from bleach import clean

print(clean(
    '<form><button formaction="javascript:alert(1)">go</button></form>',
    tags={'form', 'button'},
    attributes={'button': ['formaction']},
))

Actual output:

<form><button formaction="javascript:alert(1)">go</button></form>

Expected output:

<form><button>go</button></form>

---

2) <input type="submit">

print(clean(
    '<form><input type="submit" formaction="javascript:alert(1)" value="go"></form>',
    tags={'form', 'input'},
    attributes={'input': ['type', 'formaction', 'value']},
))

Actual output:

<form><input type="submit" formaction="javascript:alert(1)" value="go"></form>

Expected output:

<form><input type="submit" value="go"></form>

---

3) <input type="image">

print(clean(
    '<form><input type="image" formaction="javascript:alert(1)" src="/foo.png"></form>',
    tags={'form', 'input'},
    attributes={'input': ['type', 'formaction', 'src']},
))

Actual output:

<form><input type="image" formaction="javascript:alert(1)" src="/foo.png"></form>

Expected output:

<form><input type="image" src="/foo.png"></form>

---

Impact

This is a client-side HTML sanitization bypass / dangerous URI preservation issue.

If an application relies on Bleach to sanitize untrusted HTML and explicitly allows:

• formaction
• and submit-capable controls such as <button> or <input>

then Bleach can emit sanitized output that still contains a dangerous javascript: URI in formaction.

That can lead to submit-triggered JavaScript execution when the user activates the control.

Impact is limited to configurations that explicitly allow the relevant tag/attribute combination, but the issue is still security-relevant because:

• formaction is a real browser sink
• Bleach already protocol-sanitizes similar URI-bearing attributes like action
• the omission creates inconsistent sanitizer coverage for dangerous URI schemes

I would currently assess this as Medium severity.

If useful, I also have:

• a minimal patch

• focused regression tests for:

  • <button formaction="javascript:...">
  • <input type="submit" formaction="javascript:...">
  • <input type="image" formaction="javascript:...">
  • a safe control case where formaction="/submit" is preserved

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/mozilla/bleach/security/advisories/GHSA-gj48-438w-jh9v
• https://github.com/mozilla/bleach/releases/tag/v6.4.0
• https://github.com/advisories/GHSA-gj48-438w-jh9v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mozilla/bleach (bleach)

v6.4.0

Compare Source

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future
releases including for security issues.
See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

• Dropped support for pypy 3.10. (#​764)

Security fixes

• Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

  Fix XSS issue with sanitize_uri_value where disallowed schemes with
  Unicode invisible characters wouldn't be rejected.

  For example::

  import bleach
  payload1 = 'Click'
  result1 = bleach.clean(payload1)
  print(repr(result1))

  outputs::

  'Click'

  See the advisory for details.

• Fix GHSA-gj48-438w-jh9v.

  Fix issue where URI sanitization wasn't happening in formaction attributes.

  See the advisory for details.

Bug fixes

• Add support for pypy 3.11. (#​764)

• Drop version max in tinycss2 pin. (#​772)

  This removes one of the things we had to keep checking and updating. Users
  now own the responsibility for correctness with the version of tinycss2
  they're using.

v6.3.0

Compare Source

Backwards incompatible changes

• Dropped support for Python 3.9. (#​756)

Security fixes

None

Bug fixes

• Add support for Python 3.14. (#​758)
• Fix wbr handling. (#​488)

v6.2.0

Compare Source

Backwards incompatible changes

• Dropped support for Python 3.8. (#​737)

Security fixes

None

Bug fixes

• Add support for Python 3.13. (#​736)
• Remove six depdenncy. (#​618)
• Update known-good versions for tinycss2. (#​732)
• Fix additional < followed by characters and EOF issues. (#​728)

v6.1.0

Compare Source

Backwards incompatible changes

• Dropped support for Python 3.7. (#​709)

Security fixes

None

Bug fixes

• Add support for Python 3.12. (#​710)
• Fix linkify with arrays in querystring (#​436)
• Handle more cases with < followed by character data (#​705)
• Fix entities inside a tags in linkification (#​704)
• Update cap for tinycss2 to <1.3 (#​702)
• Updated Sphinx requirement
• Add dependabot for github actions and update github actions

v6.0.0

Compare Source

Backwards incompatible changes

• bleach.clean, bleach.sanitizer.Cleaner,
  bleach.html5lib_shim.BleachHTMLParser: the tags and protocols
  arguments were changed from lists to sets.

  Old pre-6.0.0:

  .. code-block:: python

  bleach.clean(
  "some text",
  tags=["a", "p", "img"],

^ ^ list

     protocols=["http", "https"],

^ ^ list

 )

New 6.0.0 and later:

.. code-block:: python

 bleach.clean(
     "some text",
     tags={"a", "p", "img"},

^ ^ set

     protocols={"http", "https"},

^ ^ set

 )

• bleach.linkify, bleach.linkifier.Linker: the skip_tags and
  recognized_tags arguments were changed from lists to sets.

  Old pre-6.0.0:

  .. code-block:: python

  bleach.linkify(
  "some text",
  skip_tags=["pre"],

^ ^ list

 )

 linker = Linker(
     skip_tags=["pre"],

^ ^ list

     recognized_tags=html5lib_shim.HTML_TAGS + ["custom-element"],

^ ^ ^ list

|

| list concatenation

 )

New 6.0.0 and later:

.. code-block:: python

 bleach.linkify(
     "some text",
     skip_tags={"pre"},

^ ^ set

 )

 linker = Linker(
     skip_tags={"pre"},

^ ^ set

     recognized_tags=html5lib_shim.HTML_TAGS | {"custom-element"},

^ ^ ^ set

|

| union operator

 )

• bleach.sanitizer.BleachSanitizerFilter: strip_allowed_elements is now
  strip_allowed_tags. We now use "tags" everywhere rather than a mishmash
  of "tags" in some places and "elements" in others.

Security fixes

None

Bug fixes

• Add support for Python 3.11. (#​675)

• Fix API weirness in BleachSanitizerFilter. (#​649)

  We're using "tags" instead of "elements" everywhere--no more weird
  overloading of "elements" anymore.

  Also, it no longer calls the superclass constructor.

• Add warning when css_sanitizer isn't set, but the style
  attribute is allowed. (#​676)

• Fix linkify handling of character entities. (#​501)

• Rework dev dependencies to use requirements-dev.txt and
  requirements-flake8.txt instead of extras.

• Fix project infrastructure to be tox-based so it's easier to have CI
  run the same things we're running in development and with flake8
  in an isolated environment.

• Update action versions in CI.

• Switch to f-strings where possible. Make tests parametrized to be
  easier to read/maintain.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dpebot]

/gcbrun

[gemini-code-assist]

Code Review

This pull request updates the bleach dependency to version 6.4.0 in requirements.txt. The reviewer correctly points out that bleach is deprecated and unmaintained as of this version, and recommends migrating to an actively maintained alternative like nh3 to mitigate long-term security risks.

[gemini-code-assist]

Bleach is officially deprecated and no longer maintained as of its v6.4.0 release (see Mozilla's announcement). Since Bleach is an HTML sanitization library, using an unmaintained package poses a long-term security risk as new vulnerabilities will not be patched.

It is highly recommended to plan a migration to an actively maintained alternative, such as nh3 (Python bindings for the Rust-based ammonia HTML sanitizer).