Skip to content
OpenAdvisories
Medium DLA-2467-1 2 CVEs

lxml - security update

Published Nov 26, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 lxml 3.7.1-1+deb9u1

Vulnerabilities 2

  • Medium 6.1
    CVE-2018-19787

    Improper Neutralization of Input During Web Page Generation in LXML

    An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explore…

    lxml lxml python-lxml lxml Debian Ubuntu Azure Linux PyPI
  • Medium 6.1
    CVE-2020-27783

    lxml vulnerable to Cross-site Scripting

    A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML…

    lxml lxml lxml python-lxml Debian Ubuntu Azure Linux Alpine PyPI