Description
lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javascript() method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression() filters, allowing external CSS loading or XSS in older browsers. This issue has been patched in version 0.4.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fedora-python | lxml_html_clean | < 0.4.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lxml | 5.2.0-1 | — |
| Debian 14 | lxml-html-clean | 0.4.4-1 | — |
| Debian 13 | lxml | 5.2.0-1 | — |
| Debian 13 | lxml-html-clean | 0.4.4-1~deb13u1 | — |
| Debian 12 | lxml | 4.9.2-1+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | lxml-html-clean | No fix yet | — |
| Ubuntu 26.04 LTS | lxml-html-clean | No fix yet | — |
| Ubuntu 25.10 | lxml-html-clean | No fix yet | — |
| Ubuntu 24.04 LTS | lxml-html-clean | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-lxml_html_clean | 0.4.4-1.1 | openSUSE-SU-2026:10322-1 |
| openSUSE Leap 16.0 | python-lxml_html_clean | 0.4.2-bp160.2.1 | openSUSE-SU-2026:20345-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | lxml-html-clean | < 0.4.4 | 0.4.4 | GHSA-hw26-mmpg-fqfg |
Advisories 2
- openSUSE-SU-2026:10322-1 python311-lxml_html_clean-0.4.4-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:20345-1 Security update for python-lxml_html_clean SUSE / openSUSE Security Updates · Mar 13, 2026