Skip to content
OpenAdvisories
High USN-5225-1 1 CVE

lxml vulnerability

Published Jan 12, 2022 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that lxml incorrectly handled certain XML and HTML files.
An attacker could possibly use this issue to execute arbitrary code.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS lxml 4.2.1-1ubuntu0.6
Ubuntu · 20.04 LTS 20.04:LTS lxml 4.5.0-1ubuntu0.5
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS lxml 3.3.3-1ubuntu0.2+esm5
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS lxml 3.5.0-1ubuntu0.4+esm2

Vulnerabilities 1

  • High 8.2
    CVE-2021-43818

    HTML Cleaner allows crafted and SVG embedded scripts to pass through

    lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ th…

    lxml lxml lxml lxml Debian Ubuntu Azure Linux Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-43818