CVE-2021-33391

Publication date 17 February 2023

Last updated 18 August 2025

Ubuntu priority

Cvss 3 Severity Score

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Show unmaintained releases

Package	Ubuntu Release	Status
tidy-html5	25.10 questing	Fixed 2:5.6.0-11ubuntu1
	25.04 plucky	Fixed 2:5.6.0-11ubuntu1
	24.10 oracular	Fixed 2:5.6.0-11ubuntu1
	24.04 LTS noble	Fixed 2:5.6.0-11ubuntu1
	23.10 mantic	Fixed 2:5.6.0-11ubuntu0.23.10.1
	23.04 lunar	Fixed 2:5.6.0-11ubuntu0.23.04.1
	22.10 kinetic	Ignored end of life, was needed
	22.04 LTS jammy	Fixed 2:5.6.0-11ubuntu0.22.04.1
	20.04 LTS focal	Fixed 2:5.6.0-11ubuntu0.20.04.1
	18.04 LTS bionic	Vulnerable
	16.04 LTS xenial	Ignored end of standard support
	14.04 LTS trusty	Ignored end of standard support

the commit below is just one of a long list of commits that are required to remove recursion from tidy-html5.

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
tidy-html5	Upstream: e56716f Upstream: efa6152