Cross-Site Scripting Vulnerability in lxml by lxml

CVE-2018-19787

What is CVE-2018-19787?

A security issue was identified in the lxml library prior to version 4.2.5, where the module lxml.html.clean does not adequately filter out javascript: URLs that make use of escaping techniques. This oversight enables a remote attacker to execute cross-site scripting (XSS) attacks. The vulnerability allows an attacker to embed harmful scripts, as evidenced by the string 'j a v a s c r i p t:', which can be particularly damaging when exploited in browsers like Internet Explorer. This resembles previously documented issues, such as CVE-2014-3146.

References