Medium Severity

HTML: Bidirectional (BIDI) HTML override with right to left obfuscation

Description

Body HTML contains multiple instances of right-to-left (RTL) text direction override markup, which can be used to visually manipulate text display and potentially bypass common strings checks.

References

No references.

Sublime Security
Created Oct 17th, 2025 • Last updated Aug 31st, 2026
Source
type.inbound
// You should only observe RTL injection when RTL languages are present.
and (
  regex.icount(body.html.raw, 'unicode-bidi\s*:\s*bidi-override[^>]*rtl') + regex.icount(body.html.raw,
                                                                                         '<bdo dir="rtl">'
  )
// Count allows for scalability for FP's.
) >= 3
// exclude legitimate CSS star-rating widgets
and not regex.icontains(body.html.raw, '\.rating[^}]*:hover')
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started