https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 21:23:40 +0000 https://vulnerability.circl.lu/vuln/cve-2021-28957 <p>An XSS vulnerability was discovered in python-lxml&#39;s clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.</p> <p>An XSS vulnerability was discovered in python-lxml&#39;s clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.</p> https://vulnerability.circl.lu/vuln/cve-2021-28957 https://vulnerability.circl.lu/vuln/ghsa-jq4v-f5q6-mjqq <p><strong>Affected:</strong> PyPI: lxml</p> <p>An XSS vulnerability was discovered in the python `lxml` clean module versions before 4.6.3. When disabling `the safe_attrs_only` and `forms` arguments, the `Cleaner` class does not remove the `formaction` attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in `lxml` 4.6.3.</p> <p><strong>Affected:</strong> PyPI: lxml</p> <p>An XSS vulnerability was discovered in the python `lxml` clean module versions before 4.6.3. When disabling `the safe_attrs_only` and `forms` arguments, the `Cleaner` class does not remove the `formaction` attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in `lxml` 4.6.3.</p> https://vulnerability.circl.lu/vuln/ghsa-jq4v-f5q6-mjqq https://vulnerability.circl.lu/vuln/pysec-2021-19 <p><strong>Affected:</strong> PyPI: lxml</p> <p>An XSS vulnerability was discovered in python-lxml&#39;s clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.</p> <p><strong>Affected:</strong> PyPI: lxml</p> <p>An XSS vulnerability was discovered in python-lxml&#39;s clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.</p> https://vulnerability.circl.lu/vuln/pysec-2021-19