VDB
GCVE-VVD-MAGEIA-2021-246
GCVE-VVD-MAGEIA-2021-246
Advisory Published
An XSS vulnerability was discovered in python-lxml’s clean module
versions before 4.6.3. When disabling the safe_attrs_only and forms
arguments, the Cleaner class does not remove the formaction attribute
allowing for JS to bypass the sanitizer. A remote attacker could exploit this
flaw to run arbitrary JS code on users who interact with incorrectly
sanitized HTML (CVE-2021-28957).
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Mageia | python-lxml | 0 (affected), 4.3.0-1.3.mga7 (unaffected) | — |
| Mageia | python-lxml | 0 (affected), 4.6.3-1.mga8 (unaffected) | — |
References
Browse GCVE Records
100 records in the GCVE database · Updated April 16, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.