A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python38-cffiUpgrade python-sqlalchemy-docUpgrade python38-requestsUpgrade python38-pysocksUpgrade python2-pyUpgrade python2-backportsUpgrade python38-idnaUpgrade python2-idnaUpgrade python2-setuptools-wheelUpgrade python38-psycopg2Upgrade python2-setuptoolsUpgrade python2-urllib3Upgrade python2-numpyUpgrade python2-sqlalchemyUpgrade python38-psycopg2-docUpgrade python2-docs-infoUpgrade python38-psycopg2-testsUpgrade python2-CythonUpgrade python2-psycopg2Upgrade python2-docutilsUpgrade python2-chardetUpgrade python2-PyMySQLUpgrade python38-cryptographyUpgrade python2-pluggyUpgrade python2-pyyamlUpgrade python2-pytest-mockUpgrade python2-numpy-docUpgrade python38-asn1cryptoUpgrade python2-psycopg2-testsUpgrade python2-rpm-macrosUpgrade python2-psycopg2-debugUpgrade python2-setuptools_scmUpgrade python38-PyMySQLUpgrade python38-pytzUpgrade python2-coverageUpgrade python2-backports-ssl_match_hostnameUpgrade python2-mockUpgrade python2-attrsUpgrade python38-scipyUpgrade python-psycopg2-docUpgrade python2-dnsUpgrade python2-sixUpgrade python2-numpy-f2pyUpgrade python2-funcsigsUpgrade python38-mod_wsgiUpgrade python2-pysocksUpgrade python2-markupsafeUpgrade python38-markupsafeUpgrade python2-pytestUpgrade python38-plyUpgrade python38-sixUpgrade python38-chardetUpgrade python38-pycparserUpgrade python2-requestsUpgrade python2-ipaddressUpgrade python2-pytzUpgrade python2-docsUpgrade python38-Cython | May 4, 2022 | Dec 3, 2020 |
| Alpine Linux | — | Upgrade py3-lxml | Jan 5, 2021 | Dec 3, 2020 |
| Amazon Linux Ami 2 | — | Upgrade python-lxml-docsUpgrade python-lxmlUpgrade python-lxml-debuginfo | Jun 24, 2021 | Dec 3, 2020 |
| Amazon_linux | — | Upgrade python-lxml | Mar 23, 2023 | Dec 3, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 3, 2020 |
| Centos_linux | — | Upgrade python2-develUpgrade python2-lxmlUpgrade python2-pysocksUpgrade python-markupsafe-debugsourceUpgrade python38-cryptography-debuginfoUpgrade python38-tkinterUpgrade python38-pyyamlUpgrade python2-debugsourceUpgrade python-psutil-debugsourceUpgrade python2-sqlalchemyUpgrade python38-wheel-wheelUpgrade scipy-debugsourceUpgrade python38-rpm-macrosUpgrade python2-requestsUpgrade python38-plyUpgrade python2-virtualenvUpgrade python38-mod_wsgiUpgrade python38-numpy-docUpgrade python2-wheel-wheelUpgrade python2-funcsigsUpgrade python2-scipy-debuginfoUpgrade python38-setuptools-wheelUpgrade python2-psycopg2Upgrade python2-setuptools_scmUpgrade python2-pygmentsUpgrade python38-scipy-debuginfoUpgrade python38-markupsafe-debuginfoUpgrade python38-psycopg2-debuginfoUpgrade python38-develUpgrade python2-PyMySQLUpgrade python38-psycopg2-docUpgrade numpy-debugsourceUpgrade python3-lxmlUpgrade python38-numpy-f2pyUpgrade python2-urllib3Upgrade python38-cffi-debuginfoUpgrade python38-wheelUpgrade python38-psutil-debuginfoUpgrade python38-psycopg2Upgrade python38-requestsUpgrade python-psycopg2-debugsourceUpgrade python2-idnaUpgrade python38-pytzUpgrade python2-pymongo-debuginfoUpgrade python-sqlalchemy-docUpgrade python38-debugUpgrade python38-idnaUpgrade python38-asn1cryptoUpgrade python38-setuptoolsUpgrade python2-numpy-docUpgrade python2-psycopg2-debuginfoUpgrade python2-psycopg2-testsUpgrade babelUpgrade python2-pymongoUpgrade python38-jinja2Upgrade python38-Cython-debuginfoUpgrade python2-setuptoolsUpgrade python38-pycparserUpgrade python38-psycopg2-testsUpgrade python2-coverage-debuginfoUpgrade python2-scipyUpgrade python2-tkinterUpgrade python2-pytest-mockUpgrade python2-pluggyUpgrade python2-pyyaml-debuginfoUpgrade python2-docsUpgrade Cython-debugsourceUpgrade python2-markupsafeUpgrade python38-debugsourceUpgrade python2-pymongo-gridfsUpgrade python2-pyUpgrade python-psycopg2-debuginfoUpgrade python2-pytzUpgrade python2-sixUpgrade python38-lxml-debuginfoUpgrade python2-numpyUpgrade python2-numpy-debuginfoUpgrade python38Upgrade python-cryptography-debugsourceUpgrade python-nose-docsUpgrade python38-scipyUpgrade python38-PyMySQLUpgrade python38-markupsafeUpgrade python38-CythonUpgrade python38-cryptographyUpgrade python2-toolsUpgrade python2-testUpgrade python2-psycopg2-debugUpgrade python2-numpy-f2pyUpgrade python2-lxml-debuginfoUpgrade python2-dnsUpgrade python2-backportsUpgrade python38-libsUpgrade python-cffi-debugsourceUpgrade python38-numpy-debuginfoUpgrade python38-lxmlUpgrade python38-psutilUpgrade python38-pip-wheelUpgrade python2-setuptools-wheelUpgrade python-pymongo-debugsourceUpgrade python38-babelUpgrade python38-cffiUpgrade python2-wheelUpgrade python2-pytestUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-noseUpgrade python2-docutilsUpgrade python2-debugUpgrade python2-bsonUpgrade python38-sixUpgrade python38-pyyaml-debuginfoUpgrade python38-chardetUpgrade python-lxml-debugsourceUpgrade python38-pipUpgrade python3-lxml-debuginfoUpgrade python2-backports-ssl_match_hostnameUpgrade python2-pip-wheelUpgrade python2-chardetUpgrade python38-debuginfoUpgrade python2-rpm-macrosUpgrade python2-libsUpgrade python38-testUpgrade python38-numpyUpgrade python2-Cython-debuginfoUpgrade PyYAML-debugsourceUpgrade python2-CythonUpgrade python2-coverageUpgrade python2-bson-debuginfoUpgrade python2-babelUpgrade python-coverage-debugsourceUpgrade python38-urllib3Upgrade python2-pyyamlUpgrade python2-ipaddressUpgrade python2-debuginfoUpgrade python38-idleUpgrade python2-mockUpgrade python2-jinja2Upgrade python2-docs-infoUpgrade python-psycopg2-docUpgrade python2-pipUpgrade python38-pysocksUpgrade python2Upgrade python-pymongo-debuginfoUpgrade python2-attrs | Jun 1, 2021 | Dec 3, 2020 |
| Debian | — | Upgrade lxml | Nov 30, 2020 | Nov 30, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-lxml | Sep 16, 2021 | Dec 3, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-lxml | Apr 30, 2021 | Dec 3, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-lxml | Mar 24, 2021 | Dec 3, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-lxmlUpgrade python3-lxmlUpgrade python2-lxml | Feb 2, 2021 | Dec 3, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-lxml | Jan 5, 2021 | Dec 3, 2020 |
| Oracle Solaris | — | Upgrade library/python/lxml-39 to version 4.6.2-11.4.31.0.1.88.2 on Solaris 11.4Upgrade library/python/lxml to version 4.6.2-11.4.31.0.1.88.2 on Solaris 11.4Upgrade library/python/lxml-37 to version 4.6.2-11.4.31.0.1.88.2 on Solaris 11.4Upgrade library/python/lxml-27 to version 4.6.2-11.4.31.0.1.88.2 on Solaris 11.4 | Mar 17, 2021 | Dec 3, 2020 |
| Oracle_linux | — | Upgrade python2-coverageUpgrade ol-automation-managerUpgrade python38-tkinterUpgrade python38-rpm-macrosUpgrade python38-pytzUpgrade python3-olamkitUpgrade python2-setuptoolsUpgrade python2-psycopg2-debugUpgrade babelUpgrade python2-docsUpgrade python38-wheel-wheelUpgrade python2-setuptools_scmUpgrade python2-pygmentsUpgrade python38-CythonUpgrade python2-pytest-mockUpgrade python3-lxmlUpgrade python2-funcsigsUpgrade python-sqlalchemy-docUpgrade python2-dnsUpgrade python38-psycopg2Upgrade python38-lxmlUpgrade python2-virtualenvUpgrade python2-docs-infoUpgrade python2-psycopg2-testsUpgrade python2-lxmlUpgrade python2-requestsUpgrade python2-markupsafeUpgrade python2-attrsUpgrade python38-pipUpgrade python2-docutilsUpgrade python2-pysocksUpgrade python2-pymongo-gridfsUpgrade python38-develUpgrade python2-toolsUpgrade python2-scipyUpgrade python38-pyyamlUpgrade python38-PyMySQLUpgrade python2-tkinterUpgrade python38-debugUpgrade python2-pymongoUpgrade python2-numpy-docUpgrade python2-CythonUpgrade python2-PyMySQLUpgrade python2-develUpgrade python38-asn1cryptoUpgrade python38-pycparserUpgrade python2-pip-wheelUpgrade python2-testUpgrade python2Upgrade python38-sixUpgrade python2-numpyUpgrade python2-bsonUpgrade python38-setuptoolsUpgrade python38-requestsUpgrade python38-mod_wsgiUpgrade python2-pytzUpgrade python2-pyUpgrade python2-ipaddressUpgrade python2-sqlalchemyUpgrade python2-pytestUpgrade python38-chardetUpgrade python38-libsUpgrade python2-debugUpgrade python2-pyyamlUpgrade python38-numpy-docUpgrade python38-psycopg2-testsUpgrade python38-scipyUpgrade python38-babelUpgrade python2-wheel-wheelUpgrade python38-testUpgrade python-nose-docsUpgrade python38-jinja2Upgrade python38-psutilUpgrade python2-backports-ssl_match_hostnameUpgrade python38-plyUpgrade python2-wheelUpgrade python38-numpy-f2pyUpgrade python38-idleUpgrade python2-jinja2Upgrade python38Upgrade python38-wheelUpgrade python2-setuptools-wheelUpgrade python2-pluggyUpgrade python2-numpy-f2pyUpgrade python38-cffiUpgrade python38-numpyUpgrade python2-backportsUpgrade python2-rpm-macrosUpgrade python38-setuptools-wheelUpgrade python38-cryptographyUpgrade python38-urllib3Upgrade python2-noseUpgrade python38-psycopg2-docUpgrade python-psycopg2-docUpgrade python2-libsUpgrade python2-sixUpgrade python2-pipUpgrade python2-urllib3Upgrade python2-babelUpgrade python38-markupsafeUpgrade python2-chardetUpgrade python38-pip-wheelUpgrade python38-idnaUpgrade python2-idnaUpgrade python2-mockUpgrade python2-psycopg2Upgrade python38-pysocksUpgrade ol-automation-manager-cli | May 26, 2021 | Oct 18, 2020 |
| Redhat_linux | — | Upgrade python2-numpy-f2pyUpgrade python38-debuginfoUpgrade python38-numpy-docUpgrade python38-asn1cryptoUpgrade python38-pytzUpgrade PyYAML-debugsourceUpgrade python2-chardetUpgrade python2-develUpgrade python38-pyyaml-debuginfoUpgrade python-coverage-debugsourceUpgrade python2-coverage-debuginfoUpgrade python2-pysocksUpgrade python2Upgrade python38-psutilUpgrade python2-libsUpgrade python2-pip-wheelUpgrade python38-cryptography-debuginfoUpgrade python2-pytzUpgrade python38-PyMySQLUpgrade python38-pycparserUpgrade python38-debugUpgrade python-pymongo-debugsourceUpgrade python2-setuptools_scmUpgrade python38-babelUpgrade python2-markupsafeUpgrade python2-debuginfoUpgrade python2-urllib3Upgrade python2-psycopg2-debugUpgrade python2-CythonUpgrade python38-numpyUpgrade python2-backportsUpgrade python38-idnaUpgrade python2-jinja2Upgrade python2-wheel-wheelUpgrade python38-wheelUpgrade python38-markupsafe-debuginfoUpgrade python38-testUpgrade python2-sixUpgrade python-cffi-debugsourceUpgrade python2-docs-infoUpgrade python38-CythonUpgrade python2-requestsUpgrade python38-Cython-debuginfoUpgrade python-markupsafe-debugsourceUpgrade python2-pytestUpgrade python38-cffiUpgrade python38-numpy-f2pyUpgrade python38-numpy-debuginfoUpgrade python2-pygmentsUpgrade python2-virtualenvUpgrade python2-scipyUpgrade python2-pymongo-gridfsUpgrade python38-scipyUpgrade python2-attrsUpgrade python38-pipUpgrade python38-lxml-debuginfoUpgrade python2-pyUpgrade python2-numpyUpgrade python38-setuptools-wheelUpgrade python2-pymongo-debuginfoUpgrade python38Upgrade python38-sixUpgrade python2-psycopg2-debug-debuginfoUpgrade numpy-debugsourceUpgrade python2-testUpgrade python2-psycopg2-debuginfoUpgrade python2-pipUpgrade python38-libsUpgrade python38-psycopg2-testsUpgrade python2-pyyaml-debuginfoUpgrade python2-wheelUpgrade python38-markupsafeUpgrade python-psycopg2-docUpgrade python-psutil-debugsourceUpgrade python38-requestsUpgrade python2-tkinterUpgrade python38-cryptographyNo solution existsUpgrade python2-lxmlUpgrade python38-plyUpgrade python2-lxml-debuginfoUpgrade python-lxml-debugsourceUpgrade python2-numpy-debuginfoUpgrade python-nose-docsUpgrade python2-numpy-docUpgrade python2-docsUpgrade python38-rpm-macrosUpgrade python38-pysocksUpgrade python2-PyMySQLUpgrade python38-pyyamlUpgrade Cython-debugsourceUpgrade python38-setuptoolsUpgrade python2-debugsourceUpgrade python2-idnaUpgrade python2-backports-ssl_match_hostnameUpgrade python2-bson-debuginfoUpgrade python38-wheel-wheelUpgrade python-cryptography-debugsourceUpgrade python38-jinja2Upgrade python2-bsonUpgrade python2-mockUpgrade python2-docutilsUpgrade python38-idleUpgrade python-psycopg2-debugsourceUpgrade python2-pymongoUpgrade python38-scipy-debuginfoUpgrade python3-lxml-debuginfoUpgrade python38-psycopg2-docUpgrade python2-pytest-mockUpgrade python3-lxmlUpgrade python2-debugUpgrade python2-psycopg2Upgrade python38-pip-wheelUpgrade python2-scipy-debuginfoUpgrade python2-psycopg2-testsUpgrade python38-psycopg2-debuginfoUpgrade python38-debugsourceUpgrade python38-psycopg2Upgrade python38-lxmlUpgrade python2-noseUpgrade python2-sqlalchemyUpgrade babelUpgrade python-pymongo-debuginfoUpgrade scipy-debugsourceUpgrade python-psycopg2-debuginfoUpgrade python2-toolsUpgrade python2-rpm-macrosUpgrade python-sqlalchemy-docUpgrade python2-coverageUpgrade python2-dnsUpgrade python38-urllib3Upgrade python2-babelUpgrade python38-develUpgrade python2-Cython-debuginfoUpgrade python2-setuptoolsUpgrade python38-cffi-debuginfoUpgrade python38-psutil-debuginfoUpgrade python2-ipaddressUpgrade python2-pyyamlUpgrade python38-chardetUpgrade python38-tkinterUpgrade python38-mod_wsgiUpgrade python2-funcsigsUpgrade python2-setuptools-wheelUpgrade python2-pluggy | May 21, 2021 | Dec 3, 2020 |
| Rocky_linux | — | Upgrade python2-psycopg2-testsUpgrade python38-lxml-debuginfoUpgrade python2-debuginfoUpgrade python38-scipyUpgrade python-cryptography-debugsourceUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-debugsourceUpgrade python38-scipy-debuginfoUpgrade python2-pymongo-gridfsUpgrade python2-CythonUpgrade python2-psycopg2-debugUpgrade python38-pyyaml-debuginfoUpgrade python38-numpy-debuginfoUpgrade numpy-debugsourceUpgrade python-coverage-debugsourceUpgrade python-cffi-debugsourceUpgrade python38-debugsourceUpgrade python38-pyyamlUpgrade python2-numpy-f2pyUpgrade python38-CythonUpgrade python2-bsonUpgrade python38-debugUpgrade python-pymongo-debugsourceUpgrade python2-lxml-debuginfoUpgrade python38Upgrade python3-lxml-debuginfoUpgrade PyYAML-debugsourceUpgrade python2-numpyUpgrade python2-backportsUpgrade python2-libsUpgrade python38-debuginfoUpgrade python38-markupsafeUpgrade python-psutil-debugsourceUpgrade python38-Cython-debuginfoUpgrade python2-markupsafeUpgrade python-psycopg2-docUpgrade python38-psycopg2-testsUpgrade python2Upgrade python2-testUpgrade python2-coverage-debuginfoUpgrade python2-Cython-debuginfoUpgrade python2-scipy-debuginfoUpgrade python2-lxmlUpgrade python2-bson-debuginfoUpgrade python38-cryptography-debuginfoUpgrade Cython-debugsourceUpgrade python2-develUpgrade python-pymongo-debuginfoUpgrade python2-pymongo-debuginfoUpgrade python2-psycopg2-debuginfoUpgrade python-psycopg2-debugsourceUpgrade python-markupsafe-debugsourceUpgrade python38-psutilUpgrade python38-testUpgrade python3-lxmlUpgrade python2-pyyaml-debuginfoUpgrade scipy-debugsourceUpgrade python38-mod_wsgiUpgrade python38-markupsafe-debuginfoUpgrade python38-cryptographyUpgrade python2-sqlalchemyUpgrade python2-scipyUpgrade python2-pyyamlUpgrade python-psycopg2-debuginfoUpgrade python-lxml-debugsourceUpgrade python38-psycopg2-docUpgrade python2-psycopg2Upgrade python2-debugUpgrade python38-psycopg2-debuginfoUpgrade python38-psycopg2Upgrade python38-numpy-f2pyUpgrade python38-lxmlUpgrade python38-develUpgrade python38-cffiUpgrade python2-tkinterUpgrade python2-toolsUpgrade python2-coverageUpgrade python38-cffi-debuginfoUpgrade python2-numpy-debuginfoUpgrade python38-psutil-debuginfoUpgrade python38-tkinterUpgrade python38-numpyUpgrade python38-idleUpgrade python38-libsUpgrade python2-pymongo | Mar 12, 2024 | Dec 3, 2020 |
| Suse | — | Upgrade python3-lxmlUpgrade python-lxmlUpgrade python2-lxmlUpgrade python3-lxml-develUpgrade python2-lxml-devel | Mar 12, 2022 | Dec 3, 2020 |
| Ubuntu | — | Upgrade python-lxml (Ubuntu Pro)Upgrade python-lxmlUpgrade python3-lxmlUpgrade python3-lxml (Ubuntu Pro) | Dec 10, 2020 | Dec 3, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 3, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub