GHSA-xp26-p53h-6h2pMediumCVSS 6.1

Improper Neutralization of Input During Web Page Generation in LXML

Published
May 13, 2022
Last Modified
September 30, 2024

🔗 CVE IDs covered (1)

CVE-2018-19787 →

📋 Description

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

🎯 Affected products1

  • pip/lxml:< 4.2.5

🔗 References (8)