CVE-2024-34078

What it actually does

Bypasses allowlist-based HTML sanitization via NFKC normalization of specific unicode characters into chevrons when keep_typographic_whitespace=False (the default), enabling crafted input to produce unsanitized output.

Why it matters to the business

Applications relying on this library for user-generated content cleaning face elevated risk of script injection that can compromise user sessions or alter page behavior, increasing support burden and potential regulatory exposure until patched.

How an attack unfolds

An attacker supplies specially crafted unicode sequences inside HTML tags that survive the allowlist checks; after processing the sanitizer normalizes the input to NFKC form, converting the characters into angle brackets that close or open tags, resulting in executable script in the rendered output.

How to fix it

Upgrade matthiask/html-sanitizer to version 2.4.2 or later (commit 024004d53f8322548ed98fbe640759667dc6fc64). If immediate upgrade is not possible, set keep_typographic_whitespace=True as a temporary mitigation while planning the update.

How to confirm the fix worked

Confirm the installed package version meets or exceeds 2.4.2, re-test previously vulnerable unicode sequences to verify they are now rejected, and review application test suites that exercise HTML sanitization paths.

Typical attack path

1. Identify an application endpoint that accepts and renders user-supplied HTML through the sanitizer with default settings.
2. Craft input containing unicode code points that NFKC-normalize to '<' or '>' characters while evading the initial allowlist.
3. Submit the payload so it is processed and stored or reflected by the application.
4. Induce a victim to view the resulting page, executing the injected script in the victim's browser context.

How to detect it

Inspect application logs and input sanitization audit trails for HTML fragments containing unusual unicode sequences near tag-like characters; correlate with any post-sanitization output that contains unexpected script or event-handler attributes.

What your security team should do

• Prioritize upgrade of html-sanitizer to 2.4.2 across all environments within the next sprint.
• Add automated dependency scanning to catch future releases of this and similar sanitization libraries.
• Review any custom configurations that set keep_typographic_whitespace=False and document the security implications.