Skip to content
OpenAdvisories
Medium DSA-2941-1 1 CVE

lxml - security update

Published Jun 1, 2014 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 7 lxml 2.3.2-1+deb7u1

Vulnerabilities 1

  • Medium 6.1
    CVE-2014-3146 Public exploit

    lxml Cross-site Scripting Via Control Characters

    Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.

    lxml lxml lxml Debian Ubuntu PyPI