Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis began by examining the provided vulnerability description, which indicated that the bleach.clean() and bleach.Cleaner() functions failed to sanitize formaction attributes. The advisory pointed to BleachSanitizerFilter.allow_token as the location of the faulty logic and attr_val_is_uri as the data structure needing a fix. By comparing the patched version v6.4.0 with the last vulnerable version v6.3.0, I identified the specific commit 970df58e9f0c55cc52244f3f0106e473a40d886d that addressed the issue. The commit diff revealed the addition of (None, 'formaction') to the attr_val_is_uri set in bleach/_vendor/html5lib/filters/sanitizer.py. This confirmed that the vulnerability was due to an omission in this set, which is used by the BleachSanitizerFilter.allow_token function to determine whether an attribute's value should be sanitized as a URI. Therefore, BleachSanitizerFilter.allow_token is the core vulnerable function. The public-facing functions bleach.clean and bleach.Cleaner.clean are also included as they are the entry points for triggering the vulnerability and would appear in any runtime profile during exploitation.
BleachSanitizerFilter.allow_tokenbleach/sanitizer.py
cleanbleach/__init__.py
Cleaner.cleanbleach/cleaner.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bleach | pip | < 6.4.0 | 6.4.0 |
javascript:formactionExamples of affected submit-capable controls include:
<button> (default submit behavior unless type="button" is set)<input type="submit"><input type="image">This appears to be a real library-side sanitizer gap rather than only an application misuse issue, because Bleach already treats similar URI-bearing attributes (such as action) as protocol-sensitive and sanitizes them.
Suggested minimal fix:
Add:
(None, 'formaction')
to attr_val_is_uri in:
bleach/_vendor/html5lib/filters/sanitizer.pyI also prepared a minimal patch and focused regression tests if helpful.
Below are minimal reproductions using bleach.clean().
<button>from bleach import clean
print(clean(
'<form><button formaction="javascript:alert(1)">go</button></form>',
tags={'form', 'button'},
attributes={'button': ['formaction']},
))
Actual output:
<form><button formaction="javascript:alert(1)">go</button></form>
Expected output:
<form><button>go</button></form>
<input type="submit">print(clean(
'<form><input type="submit" formaction="javascript:alert(1)" value="go"></form>',
tags={'form', 'input'},
attributes={'input': ['type', 'formaction', 'value']},
))
Actual output:
<form><input type="submit" formaction="javascript:alert(1)" value="go"></form>
Expected output:
<form><input type="submit" value="go"></form>
<input type="image">print(clean(
'<form><input type="image" formaction="javascript:alert(1)" src="/foo.png"></form>',
tags={'form', 'input'},
attributes={'input': ['type', 'formaction', 'src']},
))
Actual output:
<form><input type="image" formaction="javascript:alert(1)" src="/foo.png"></form>
Expected output:
<form><input type="image" src="/foo.png"></form>
This is a client-side HTML sanitization bypass / dangerous URI preservation issue.
If an application relies on Bleach to sanitize untrusted HTML and explicitly allows:
formaction<button> or <input>then Bleach can emit sanitized output that still contains a dangerous javascript: URI in formaction.
That can lead to submit-triggered JavaScript execution when the user activates the control.
Impact is limited to configurations that explicitly allow the relevant tag/attribute combination, but the issue is still security-relevant because:
formaction is a real browser sinkactionI would currently assess this as Medium severity.
If useful, I also have:
a minimal patch
focused regression tests for:
<button formaction="javascript:..."><input type="submit" formaction="javascript:..."><input type="image" formaction="javascript:...">formaction="/submit" is preserved
PythonPython