CVE-2024-34078: Late Unicode Normalization Bypass
Performing Unicode normalization (like NFKC or NFC) at the end of a sanitization or filtering function can lead to security bypasses. Attackers can use alternative full-width Unicode characters (e.g., '＜') that bypass initial HTML element filtering, and are later normalized into dangerous characters (e.g., '<') before output. Normalization should occur befor
Pythongreprules fetch cve-2024-34078-late-unicode-normalization-bypass --engine opengrepDescription
Performing Unicode normalization (like NFKC or NFC) at the end of a sanitization or filtering function can lead to security bypasses. Attackers can use alternative full-width Unicode characters (e.g., '＜') that bypass initial HTML element filtering, and are later normalized into dangerous characters (e.g., '<') before output. Normalization should occur befor
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0