CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3

Medium · published March 21, 2021

CVSS v3.1
6.1
EPSS
4%
Percentile
90.6
In the wild
Unconfirmed
What it is

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.04035 · 90.6th percentile
Published
2021-03-21T04:39Z
EPSS history
Timeline
  • 21 MAR 04:39Z
    An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3
    cvelistv5