# CVE-2018-7753: python3-bleach: An issue was discovered in Bleach 2.1.x before 2.1.3

CVE-2018-7753 is fixed in 2 products on 1 platform, first by python-bleach 2.1.2-1ubuntu0.1~esm1, released February 16, 2023. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2018-7753
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0217
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 7, 2018

## Description

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | python-bleach Ubuntu 18.04.6 LTS (bionic) | 2.1.2-1ubuntu0.1~esm1 | [python-bleach 2.1.2-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-bleach-2.1.2-1ubuntu0.1-esm1.md) | Feb 16, 2023 |
| Linux | python3-bleach Ubuntu 18.04.6 LTS (bionic) | 2.1.2-1ubuntu0.1~esm1 | [python3-bleach 2.1.2-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-bleach-2.1.2-1ubuntu0.1-esm1.md) | Feb 16, 2023 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo