Arbitrary HTML present after sanitization because of unicode normalization
Date: 2024-05
Affected: pip/html-sanitizer
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-34078

### Impact If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. ### Patches The problem has been fixed in 2.4.2. ### Workarounds Set `keep_typographic_whitespace=True` explicitly, or normalize to NFKC yourself earlier.


Mitigations:

Architectural layers (MAESTRO):