XSS Vulnerability in Python-lxml's Cleaner Class
CVE-2021-28957

6.1MEDIUM

Key Information:

Vendor: Lxml
Status: Lxml
Vendor: CVE Published:; 21 March 2021

What is CVE-2021-28957?

In Python-lxml's clean module, versions prior to 4.6.3, a vulnerability exists that allows for Cross-Site Scripting (XSS) via the Cleaner class. If both the safe_attrs_only and forms parameters are disabled, the formaction attribute is not removed, enabling potential bypass of the HTML sanitizer. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript code on users who interact with the improperly sanitized HTML content. This vulnerability has been addressed in lxml version 4.6.3, emphasizing the importance of updating to secure your applications.