Skip to content
OpenAdvisories
Medium DSA-4880-1 1 CVE

lxml - security update

Published Mar 29, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 lxml 4.3.2-1+deb10u3

Vulnerabilities 1

  • Medium 6.1
    CVE-2021-28957

    lxml vulnerable to Cross-Site Scripting

    An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…

    lxml lxml python-lxml lxml Debian Ubuntu Azure Linux Alpine PyPI