Skip to content
OpenAdvisories
Medium USN-4896-1 1 CVE

lxml vulnerability

Published Mar 30, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that lxml incorrectly handled certain HTML attributes. A
remote attacker could possibly use this issue to perform cross-site
scripting (XSS) attacks.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS lxml 3.5.0-1ubuntu0.4
Ubuntu · 18.04 LTS 18.04:LTS lxml 4.2.1-1ubuntu0.4
Ubuntu · 20.04 LTS 20.04:LTS lxml 4.5.0-1ubuntu0.3

Vulnerabilities 1

  • Medium 6.1
    CVE-2021-28957

    lxml vulnerable to Cross-Site Scripting

    An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…

    lxml lxml python-lxml lxml Debian Ubuntu Azure Linux Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-28957