Skip to content
OpenAdvisories
Medium USN-2217-1 1 CVE

lxml vulnerability

Published May 21, 2014 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the lxml.html.clean module incorrectly stripped
control characters. An attacked could potentially exploit this to conduct
cross-site scripting (XSS) attacks.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS lxml 3.3.3-1ubuntu0.1

Vulnerabilities 1

  • Medium 6.1
    CVE-2014-3146 Public exploit

    lxml Cross-site Scripting Via Control Characters

    Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.

    lxml lxml lxml Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2014-3146