Skip to content
OpenAdvisories
Medium USN-4666-2 1 CVE

lxml vulnerability

Published Dec 11, 2020 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

USN-4666-1 partially fixed a vulnerability in lxml, but an additional patch was needed. This update provides
the corresponding additional patch in order to properly fix the vulnerability.

Original advisory details:

It was discovered that lxml incorrectly handled certain HTML.
An attacker could possibly use this issue to cross-site scripting (XSS) attacks.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS lxml 3.5.0-1ubuntu0.3
Ubuntu · 18.04 LTS 18.04:LTS lxml 4.2.1-1ubuntu0.3
Ubuntu · 20.04 LTS 20.04:LTS lxml 4.5.0-1ubuntu0.2
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS lxml 3.3.3-1ubuntu0.2+esm2

Vulnerabilities 1

  • Medium 6.1
    CVE-2020-27783

    lxml vulnerable to Cross-site Scripting

    A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML…

    lxml lxml lxml py3-lxml Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-27783