Skip to content
OpenAdvisories
Medium ALSA-2021:4158 1 CVE

Moderate: python-lxml security update

Published Nov 9, 2021 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API.

Security Fix(es):

* python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 8 python3-lxml 4.2.3-3.el8

Vulnerabilities 1

  • Medium 6.1
    CVE-2021-28957

    lxml vulnerable to Cross-Site Scripting

    An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…

    lxml lxml python-lxml lxml Debian Ubuntu Azure Linux Alpine PyPI

References

  • report
    https://vulners.com/cve/CVE-2021-28957