VDB
PYSEC-2021-19
PYSEC-2021-19
PUBLISHED
CVSS 9.300000190734863 CRITICAL
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | lxml | 0, 0, 0.9.1 |
Timeline
- Mar 21, 2021 CVE Published
- Nov 8, 2023 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
References
- https://github.com/advisories/GHSA-jq4v-f5q6-mjqq advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html advisory
- https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270 fix
- https://bugs.launchpad.net/lxml/+bug/1888153 url
- https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999 patch
- https://www.debian.org/security/2021/dsa-4880 advisory