CVE-2020-6817

bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

• CWE-1333
• CWE-1333

• https://bugzilla.mozilla.org/show_bug.cgi?id=1623633Exploit, Issue Tracking
• https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmmVendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1623633Exploit, Issue Tracking
• https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmmVendor Advisory

Published

Feb 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6811The 'Copy as cURL' feature of Devtools' network tab did not …8.8
• CVE-2020-6812The first time AirPods are connected to an iPhone, they beco…5.3
• CVE-2020-6813When protecting CSS blocks with the nonce feature of Content…5.3
• CVE-2020-6814Mozilla developers reported memory safety bugs present in Fi…9.8
• CVE-2020-6815Mozilla developers reported memory safety and script safety …9.8
• CVE-2020-6816In Mozilla Bleach before 3.12, a mutation XSS in bleach.clea…6.1
• CVE-2020-6819Under certain conditions, when running the nsDocShell destru…8.1
• CVE-2020-6820Under certain conditions, when handling a ReadableStream, a …8.1
• CVE-2020-6821When reading from areas partially or fully outside the sourc…7.5
• CVE-2020-6822On 32-bit builds, an out of bounds write could have occurred…8.8
• CVE-2020-6823A malicious extension could have called <code>browser.identi…9.8
• CVE-2020-6824Initially, a user opens a Private Browsing Window and genera…2.8