Skip to content
OpenAdvisories
Medium USN-4896-2 1 CVE

lxml vulnerability

Published Apr 8, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

USN-4896-1 fixed a vulnerability in lxml. This update provides
the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that lxml incorrectly handled certain HTML attributes. A
remote attacker could possibly use this issue to perform cross-site
scripting (XSS) attacks.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS lxml 3.3.3-1ubuntu0.2+esm3

Vulnerabilities 1

  • Medium 6.1
    CVE-2021-28957

    lxml vulnerable to Cross-Site Scripting

    An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…

    lxml lxml python-lxml lxml Debian Ubuntu Azure Linux Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-28957