CVE-2020-6816

An attacker crafts HTML containing a `math` or `svg` tag that embeds an RCDATA tag (e.g., `script` or `style`) with a malicious payload. The attacker must ensure that the application calls `bleach.clean` with `strip=False` and that both the `math`/`svg` tag and at least one RCDATA tag are in the allowed tags whitelist. Because Bleach's parser does not treat the embedded RCDATA content the same way a browser does, the payload is not escaped and executes as JavaScript when the sanitized output is rendered [patch_id=1666590].

The vulnerability resides in the `bleach.clean` function's handling of embedded MathML and SVG content containing RCDATA tags. When `strip=False` and RCDATA tags such as `script`, `style`, or `iframe` are whitelisted alongside `math` or `svg`, the parser does not match browser behavior, allowing malicious content to survive sanitization.

The patch updates the version to 3.1.2 and documents the security fix in the changelog [patch_id=1666590]. While the diff shown is limited to version metadata, the accompanying advisory indicates that the fix corrects how `bleach.clean` parses embedded MathML and SVG content containing RCDATA tags so that it matches browser parsing behavior. This closes the mutation XSS by ensuring that RCDATA content inside `math`/`svg` tags is properly escaped or stripped rather than being treated as raw HTML.