https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T23:51:43.779547+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2024-34078 fkie_cve-2024-34078 2026-11-13T23:51:43.784009+00:00

html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.

 https://db.gcve.eu/vuln/ghsa-wvhx-q427-fgh3 GHSA-wvhx-q427-fgh3 — Arbitrary HTML present after sanitization because of unicode normalization 2026-11-13T23:51:43.784161+00:00

Affected: PyPI: html-sanitizer

### Impact

If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization.

### Patches

The problem has been fixed in 2.4.2.

### Workarounds

Set `keep_typographic_whitespace=True` explicitly, or normalize to NFKC yourself earlier.

 https://db.gcve.eu/vuln/pysec-2026-1455 PYSEC-2026-1455 — Arbitrary HTML present after sanitization because of unicode normalization 2026-11-13T23:51:43.784206+00:00

Affected: PyPI: html-sanitizer

### Impact

If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization.

### Patches

The problem has been fixed in 2.4.2.

### Workarounds

Set `keep_typographic_whitespace=True` explicitly, or normalize to NFKC yourself earlier.

 https://db.gcve.eu/vuln/ubuntu-cve-2024-34078 UBUNTU-CVE-2024-34078 2026-11-13T23:51:43.784245+00:00

Affected: Ubuntu:22.04:LTS: python-html-sanitizer, Ubuntu:24.04:LTS: python-html-sanitizer

html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.