bleach
An easy safelist-based HTML-sanitizing tool.
Decision gist · record as of 2026-08-14
No. Bleach is abandoned as of June 5, 2026 with no future security updates. While the final release includes recent XSS fixes and the codebase is stable, any new security vulnerability will never be patched. For new projects, choose an actively maintained HTML sanitizer. For existing deployments, plan a migration path and audit your threat model carefully—the lack of vendor support is a critical operational risk.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10 or later; no longer receives security updates.
- Installation is straightforward with low friction, but the package is abandoned as of June 5, 2026, with no future maintenance or security updates planned.
- Existing deployments should plan migration.
License · maintenance · safety
Apache Software License (permissive) — Licensed under Apache Software License (permissive), so commercial and private use are permitted, but the abandoned status means no vendor support for license-related issues.
last release 2026-06-05 (70 days) · last repo commit 2026-06-05 · 2,769 stars · archived
0 known vulnerabilities (OSV.dev, 2026-08-14) · 78,637,646 downloads/mo, #433 on PyPI
Alternatives
Verify before relying
pip install bleach
import bleach
bleach.clean('an <script>evil()</script> example')
bleach.linkify('an http://example.com url')- Whether existing security fixes in 6.4.0 (GHSA-8rfp-98v4-mmr6, GHSA-gj48-438w-jh9v) address all known attack vectors for your use case.
- Whether the package's HTML5 parsing behavior via html5lib matches your application's security requirements after abandonment.
- Long-term compatibility of the single runtime dependency webencodings with future Python versions.
What it is and what it does
Bleach is an allowed-list-based HTML sanitizer designed to clean markup from untrusted sources. It escapes or strips HTML tags and attributes that fall outside a whitelist, and can linkify plain-text URLs safely. The library relies on html5lib for parsing, so it handles malformed or quirky HTML fragments the way modern browsers do, automatically fixing unbalanced or mis-nested tags.
As of June 5, 2026, Bleach is no longer maintained and will receive no future releases, including security patches. The final version (6.4.0) includes fixes for two XSS vulnerabilities (GHSA-8rfp-98v4-mmr6 and GHSA-gj48-438w-jh9v) but represents a hard stop for the project. Existing users should treat this as a legacy dependency and plan migration to an actively maintained alternative.
Use it for
- Sanitize user-submitted HTML in comment systems or rich-text editors to prevent XSS attacks.
- Clean HTML email bodies or newsletter content from untrusted sources before rendering.
- Linkify plain URLs in user-generated text while safely setting rel attributes on links.
- Strip or escape dangerous markup in forum posts or wiki content before storage.
- Normalize malformed HTML fragments from web scrapers or third-party APIs.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
No.
Bleach is abandoned as of June 5, 2026 with no future security updates. While the final release includes recent XSS fixes and the codebase is stable, any new security vulnerability will never be patched. For new projects, choose an actively maintained HTML sanitizer. For existing deployments, plan a migration path and audit your threat model carefully—the lack of vendor support is a critical operational risk.
Install
bleach on PyPI
Before you install
Installation is straightforward with low friction, but the package is abandoned as of June 5, 2026, with no future maintenance or security updates planned. Existing deployments should plan migration.
Requires Python 3.10 or later; no longer receives security updates.
License in practice
Licensed under Apache Software License (permissive), so commercial and private use are permitted, but the abandoned status means no vendor support for license-related issues.
Quickstart
pip install bleach
import bleach
bleach.clean('an <script>evil()</script> example')
bleach.linkify('an http://example.com url')Verify before relying
- Whether existing security fixes in 6.4.0 (GHSA-8rfp-98v4-mmr6, GHSA-gj48-438w-jh9v) address all known attack vectors for your use case.
- Whether the package's HTML5 parsing behavior via html5lib matches your application's security requirements after abandonment.
- Long-term compatibility of the single runtime dependency webencodings with future Python versions.
Package facts
| License | Apache Software License permissive |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagewebencodings |
| Maintenance | Abandoned 70 days since the last release |
| Last repo commit | repository archived |
| First released | |
| Downloads | 78,637,646 / month, #433 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 7 - InactiveEnvironment :: Web EnvironmentIntended Audience :: DevelopersOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: Implementation :: CPythonProgramming Language :: Python :: Implementation :: PyPyTopic :: Software Development :: Libraries :: Python Modules |
Evidence: bleach-6.4.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “xss prevention”
- bleachBleach sanitizes untrusted HTML by escaping or stripping markup and…
- nh3nh3 sanitizes HTML by removing unsafe tags and attributes, exposing…
- MarkupSafeMarkupSafe provides a text object that escapes special characters so…
Give your agent the search over MCP, or paste the wish link into any chat.
More Python Modules packages
Converts domain names between Unicode and ASCII-compatible encoding (Punycode) according to IDNA 2008 and Unicode Technical Standard 46, with security validation and broader script coverage than the standard library.
Install it if you work with internationalized domain names, need to validate domains, or use HTTP clients that depend on it transitively.
Setuptools is a Python build backend and package management tool that handles building, distributing, and installing Python packages, including support for C/C++ extension modules.
PyYAML parses and emits YAML 1.1 data format, enabling serialization and deserialization of configuration files and Python objects to and from human-readable YAML text.
Pydantic validates Python data structures against type hints, coercing and checking input at runtime to ensure it matches a declared schema.
Provides reusable metadata objects for use with PEP-593 `typing.Annotated` to express common constraints like bounds, collection sizes, and predicates on types.
Install it if you use or build libraries that need to express type constraints in a standardized, inspectable way—or if you want to annotate your own types with…
Provides runtime tools to inspect and introspect Python type annotations, enabling programmatic examination of type hints at execution time.
See also bleach-allowlist · django-bleach · MarkupSafe · nh3 · lxml-html-clean · django-markdownify · py_svg_hush · types-bleach · html-sanitizer · turbohtml