Skip to content
OpenAdvisories
Medium USN-3841-1 1 CVE

lxml vulnerability

Published Dec 10, 2018 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that lxml incorrectly handled certain HTML files.
An attacker could possibly use this issue to conduct cross-site scripting
(XSS) attacks.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS lxml 3.3.3-1ubuntu0.2
Ubuntu · 16.04 LTS 16.04:LTS lxml 3.5.0-1ubuntu0.1
Ubuntu · 18.04 LTS 18.04:LTS lxml 4.2.1-1ubuntu0.1

Vulnerabilities 1

  • Medium 6.1
    CVE-2018-19787

    Improper Neutralization of Input During Web Page Generation in LXML

    An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explore…

    lxml lxml python-lxml lxml Debian Ubuntu Azure Linux PyPI

References

  • report
    https://ubuntu.com/security/CVE-2018-19787