bleach

An easy safelist-based HTML-sanitizing tool.

bleach Permissive license Apache Software License Abandoned ★ 2,769 v6.4.0 released 2026-06-05

Install

bleach on PyPI

pip

pip install bleach

uv

uv add bleach

poetry

poetry add bleach

Package facts

License	Apache Software License (permissive)
Python support	supports the current Python release (>=3.10)
Install friction	low — pure-Python wheel
Runtime dependencies	1 — webencodings
Maintenance	abandoned — 69 days since the last release
Last repo commit	2026-06-05 (repository archived)
First released	2010-02-23
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: bleach-6.4.0-py3-none-any.whl

Development Status :: 7 - InactiveEnvironment :: Web EnvironmentIntended Audience :: DevelopersOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: Implementation :: CPythonProgramming Language :: Python :: Implementation :: PyPyTopic :: Software Development :: Libraries :: Python Modules

About bleach

from the package's own PyPI description — quoted content, verbatim

====== Bleach ======

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes.

Bleach can also linkify text safely, applying filters that Django's urlize filter cannot, and optionally setting rel attributes, even on links already in the text.

Bleach is intended for sanitizing text from untrusted sources. If you find yourself jumping through hoops to allow your site administrators to do lots of things, you're probably outside the use cases. Either trust those users, or don't.

Because it relies on html5lib_, Bleach is as good as modern browsers at dealing with weird, quirky HTML fragments. And any of Bleach's methods will fix unbalanced or mis-nested tags.

The version on GitHub_ is the most up-to-date and contains the latest bug fixes. You can find full documentation on ReadTheDocs_.

:Code: https://github.com/mozilla/bleach :Documentation: https://bleach.readthedocs.io/ :Issue tracker:...

Read as markdown · JSON record · Source repository · Homepage

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Bleach is an allowed-list-based HTML sanitizer that escapes or strips markup and attributes from untrusted text, and can safely linkify URLs with configurable filters.

Installation is straightforward with a single runtime dependency (webencodings), but the package is no longer maintained as of June 5, 2026, with no future releases planned including for security issues.

Licensed under Apache Software License (permissive), allowing broad use, modification, and distribution with minimal restrictions.

Usage

pip install bleach

import bleach

bleach.clean('<script>evil()</script> text')
bleach.linkify('visit http://example.com')

Requires Python 3.10 or later; package is no longer maintained and will not receive security updates.

Verdict: Bleach remains a capable HTML sanitizer with low install friction, but its abandonment as of June 2026 with no future security releases makes it unsuitable for new projects handling untrusted input. Existing users should plan migration to an actively maintained alternative.

Needs verification

Whether any known security vulnerabilities exist that predate the maintenance cessation announcement
Practical impact of the two security fixes in version 6.4.0 (GHSA-8rfp-98v4-mmr6 and GHSA-gj48-438w-jh9v) on real-world deployments

html sanitizationxss preventionhtml escapingsafe html cleaningurl linkificationmarkup strippinghtml allowlist filter