PatchTheCVEbluemonday vulnerabilities and fixes
Recent CVEs affecting bluemonday, with upgrade or downgrade steps. 2 tracked.
bluemonday has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2021-10-18. Highest priority: CVE-2021-42576 (score 63/100).
- CVE-2021-42576 CRITICAL 9.8 UPGRADE UPGRADE The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properl
- CVE-2021-29272 MEDIUM 6.1 UPGRADE bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, de
FAQ
How do I fix bluemonday vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is bluemonday being exploited right now?
None of the tracked bluemonday CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which bluemonday CVE should I patch first?
CVE-2021-42576 currently ranks highest (63/100): The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properl.