CVE:CVE-2021-42576
CNNVD:CNNVD-202110-1261
David Kitchen bluemonday是 David Kitchen开源的一个应用程序。用于在Go中实现的HTML清理程序。
bluemonday sanitizer 存在安全漏洞，该漏洞源于Go中1.0.16之前的bluemonday和Python中 0.0.8之前的bluemonday(在pybluemonday中)，不能正确地强制与SELECT、STYLE和OPTION元素关联的策略。
solution:Upgrade microco bluemonday to a higher version than 1.0.16,and avoid the version (,1.0.16); Upgrade python pybluemonday to a higher version than 0.0.8,and avoid the version (,0.0.8)