Medium WID-SEC-2024-3505 1 CVE

lxml: Schwachstelle ermöglicht Cross-Site Scripting

Published Nov 19, 2024 · Updated Nov 19, 2024 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in lxml ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

lxml ist ein XML-Toolkit für Python, das die C-Bibliotheken libxml2 und libxslt verwendet.

Vulnerabilities 1

High 7.7

CVE-2024-52595

HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through

lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `<svg>`, `<math>` and `<noscript>`. This beh…

fedora-python lxml_html_clean lxml-html-clean lxml-html-clean Debian Ubuntu PyPI

Nov 19, 2024

Revision history

2024-11-19 #1
Initiale Fassung

References

Github Advisory Database vom 2024-11-19
https://github.com/advisories/GHSA-5jfw-gq64-q45f