xss-utils

library1.0.0pypypiunverified

xss-utils provides utility functions to sanitize and escape content in Django and Mako templates, helping prevent cross-site scripting (XSS) attacks. Current version 1.0.0 supports Python 3.12, Django up to 5.2, and has dropped Python 3.11. The library is maintained by the Open edX project with regular updates.

auth-security web-framework

pip install xss-utils

github ↗package ↗

INSTALL

IMPORT

SIG · XSS-UTILS

xss-utils

auth-securitypythonv1.0.0

Install

3.6s avg

Import

—

Disk

66MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v1.0.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 66.4MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 3.6s · import 0.000s · 67MB

66MB installed

● package 66MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

strip_all_tags_unsafe

✓ from xss_utils import strip_all_tags_unsafe

✗ from xss_utils.utils import strip_all_tags_unsafe

Sanitize HTML by escaping all HTML tags, preventing XSS injection.

from xss_utils.utils import sanitize_html # Example unsanitized HTML unsafe_html = '<script>alert("xss")</script><p>Safe text</p>' safe_html = sanitize_html(unsafe_html) print(safe_html) # Output: <script>alert("xss")</script><p>Safe text</p>

Debug

Known issues

breakingVersion 1.0.0 dropped Python 3.11 support. Use Python 3.12+.

fix

Upgrade to Python 3.12 or later.

affects: >=1.0.0

gotchaThe function strip_all_tags_unsafe does NOT sanitize HTML attributes or scripts; it only strips tags. For safe escaping, use sanitize_html instead.

fix

Use sanitize_html for full escaping of HTML content.

affects: all

deprecatedImporting from xss_utils directly is deprecated in favor of importing from xss_utils.utils or xss_utils.filters.

fix

Update imports: from xss_utils.utils import sanitize_html

affects: >=1.0.0

Upgrade

Version history

1.0.0latest on PyPI · released Mar 13, 2026

Audit

Dependencies

No dependency data recorded yet.

Agent activity

31 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/openedx/xss-utils ↗

packagehttps://pypi.org/project/xss-utils/ ↗