script>alert('xss');<script>\"` regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.","image":"https://o3.security/opengraph.png","datePublished":"2020-09-03T17:13:45Z","dateModified":"2020-08-31T18:44:51Z","url":"https://o3.security/vulnerability/GHSA-5634-rv46-48jf","inLanguage":"en","author":{"@id":"https://o3.security/#organization"},"publisher":{"@id":"https://o3.security/#organization"},"mainEntityOfPage":{"@type":"WebPage","@id":"https://o3.security/vulnerability/GHSA-5634-rv46-48jf"},"speakable":{"@type":"SpeakableSpecification","cssSelector":["h1",".vuln-summary",".vuln-severity",".vuln-mitigation"]},"about":[{"@type":"SoftwareApplication","name":"bleach","applicationCategory":"npm"}],"citation":[{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/GHSA-5634-rv46-48jf"},{"@type":"CreativeWork","url":"https://www.npmjs.com/advisories/1034"}]}script>alert('xss');<script>\"` regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.","url":"https://o3.security/vulnerability/GHSA-5634-rv46-48jf","identifier":"GHSA-5634-rv46-48jf","datePublished":"2020-09-03T17:13:45Z","dateModified":"2020-08-31T18:44:51Z","inLanguage":"en","license":"https://creativecommons.org/licenses/by/4.0/","keywords":["GHSA-5634-rv46-48jf","CVE","vulnerability","security advisory"],"creator":{"@id":"https://o3.security/#organization"},"isAccessibleForFree":true,"citation":[{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/GHSA-5634-rv46-48jf"}]}script>alert('xss');<script>\"` regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available."}},{"@type":"Question","name":"How severe is GHSA-5634-rv46-48jf?","acceptedAnswer":{"@type":"Answer","text":"No CVSS score has been assigned to GHSA-5634-rv46-48jf yet. Review the advisory details and affected package list to assess your exposure."}},{"@type":"Question","name":"Which packages are affected by GHSA-5634-rv46-48jf?","acceptedAnswer":{"@type":"Answer","text":"GHSA-5634-rv46-48jf affects the following packages: bleach (npm). Ecosystems affected: npm."}},{"@type":"Question","name":"How do I fix GHSA-5634-rv46-48jf?","acceptedAnswer":{"@type":"Answer","text":"No patched version of bleach has shipped for GHSA-5634-rv46-48jf yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation."}},{"@type":"Question","name":"How do I detect GHSA-5634-rv46-48jf in my npm dependencies?","acceptedAnswer":{"@type":"Answer","text":"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for bleach, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version."}},{"@type":"Question","name":"How do I mitigate GHSA-5634-rv46-48jf if there is no patch (or I can't update yet)?","acceptedAnswer":{"@type":"Answer","text":"Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page."}},{"@type":"Question","name":"Is GHSA-5634-rv46-48jf actively exploited in the wild?","acceptedAnswer":{"@type":"Answer","text":"No public exploit code has been indexed for GHSA-5634-rv46-48jf yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure."}},{"@type":"Question","name":"When was GHSA-5634-rv46-48jf published, and has it been updated?","acceptedAnswer":{"@type":"Answer","text":"GHSA-5634-rv46-48jf was published on September 3, 2020 and was last updated on August 31, 2020. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting."}}]}
Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

Cross-Site Scripting in bleachGHSA-5634-rv46-48jf

GHSA-5634-rv46-48jf is a security vulnerability in bleach. No vendor fix is recorded yet; mitigation options are listed below.

Published
Updated
Affected
1 pkg
Patched
None yet
Exploits
None indexed
Exploitation data as of Aug 31, 2020 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

3other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
bleachnpm
163downloads / week

Description

All versions of bleach are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as "<<script><</script>script>alert('xss');</<script><</script>script>" regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected Packages

1 total
EcosystemPackageVulnerable rangeFix
📦npmbleach≥ 0.0.0No fix

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for bleach, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Remediation status

    No patched version of bleach has shipped for GHSA-5634-rv46-48jf yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.

  3. Mitigate without a patch

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

All versions of `bleach` are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as `"<<script><</script>script>alert('xss');</<script><</script>script>"` regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser. ## Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.
O3 Security · Impact-Aware SCA

Is GHSA-5634-rv46-48jf in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Cross-Site Scripting in bleach