CVE-2024-34078

Summary

CVE-2024-34078 affects the html-sanitizer library, which is used to clean HTML inputs. The vulnerability arises when the `keep_typographic_whitespace` option is set to False, causing Unicode characters to be normalized to NFKC form. Some Unicode characters normalize to chevrons, enabling malicious HTML to bypass sanitization. This issue has been rectified in version 2.4.2.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.