« Volver al listado

CVE-2024-34078

Estado: AplazadaMedia (6.1)—

html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Html-sanitizer — Html-sanitizerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-34078",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34078",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-06T20:39:29.806844Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "matthiask",
          "product": "html-sanitizer",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.4.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-05-06T15:15:24.187",
  "references": [
    {
      "url": "https://github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/08/msg00000.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2.\n"
    },
    {
      "lang": "es",
      "value": "html-sanitizer es un limpiador HTML basado en listas permitidas. Si usa `keep_typographic_whitespace=False` (que es el valor predeterminado), el desinfectante normaliza Unicode al formulario NFKC al final. Algunos caracteres Unicode se normalizan como galones; esto permite que el HTML especialmente manipulado escape al saneamiento. El problema se solucionó en 2.4.2."
    }
  ],
  "lastModified": "2026-06-17T07:32:51.770",
  "sourceIdentifier": "security-advisories@github.com"
}