Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
Date: 2026-06
Affected: pip/bleach
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Summary Bleach `clean()` / `Cleaner()` fails to sanitize dangerous URI schemes in allowed `formaction` attributes. Bleach applies URI protocol sanitization only to attributes listed in `attr_val_is_uri`. While URI-bearing attributes such as `action`, `href`, `src`, and `poster` are included in that set, `formaction` is not. As a result, if a downstream application explicitly allows `formaction` on submit-capable controls in untrusted HTML, Bleach preserves dangerous values such as `javascript:alert(1)` instead of stripping them. This can lead to **submit-triggered JavaScript execution** in applications that rely on Bleach to sanitize untrusted HTML and allow the relevant tag/attribute combination. --- ### Details The issue appears to be a URI-sanitization coverage gap in Bleach’s sanitizer logic. Relevant code paths: * `bleach/sanitizer.py` — `BleachSanitizerFilter.allow_token` (around line 553) * `bleach/_vendor/html5lib/filters/sanitizer.py` — `attr_val_is_uri` (around line 525) In `BleachSanitizerFilter.allow_token`, URI protocol sanitization is only applied when: ```python id="pft79m" if namespaced_name in self.attr_val_is_uri: ``` However, `(None, 'formaction')` is currently missing from `attr_val_is_uri`. This creates an inconsistency where `action` is protocol-sanitized, but `formaction` is not. As a result, if a downstream application allows: * tags such as `<button>` or `<input>` * the `formaction` attribute then Bleach preserves dangerous URI sche


Mitigations:

Architectural layers (MAESTRO):