Skip to content
OpenAdvisories

Archive

21 March 2021

Vulnerabilities first published on this day (UTC), newest first.

1 result · Clear filters · Feed

  • Medium 6.1

    lxml vulnerable to Cross-Site Scripting

    An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…