Skip to content
OpenAdvisories
Medium DLA-2606-1 1 CVE

lxml - security update

Published Mar 24, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 lxml 3.7.1-1+deb9u4

Vulnerabilities 1

  • Medium 6.1
    CVE-2021-28957

    lxml vulnerable to Cross-Site Scripting

    An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…

    lxml lxml python-lxml lxml Debian Ubuntu Azure Linux Alpine PyPI