An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-lxml-docsUpgrade python-lxml-debuginfoUpgrade python-lxml | Feb 14, 2025 | Dec 2, 2018 |
| Debian | — | Upgrade lxml | Feb 20, 2019 | Dec 2, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-lxml | Feb 22, 2021 | Dec 2, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-lxml | Apr 30, 2021 | Dec 2, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-lxml | Nov 2, 2020 | Dec 2, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-lxmlUpgrade python-lxmlUpgrade python3-lxml | Dec 15, 2020 | Dec 2, 2018 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-lxml | Oct 26, 2020 | Dec 2, 2018 |
| Oracle Solaris | — | Upgrade library/python/paramiko-35 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-27 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-27 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-35 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3-27 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-34 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-34 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-27 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-35 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-34 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3-34 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3-35 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4 | Jul 17, 2019 | Dec 2, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 2, 2018 |
| Suse | — | suse-upgrade-python-lxmlsuse-upgrade-python2-lxmlsuse-upgrade-python2-lxml-develsuse-upgrade-python3-lxmlsuse-upgrade-python3-lxml-devel | Mar 12, 2022 | Dec 2, 2018 |
| Ubuntu | ubuntu-upgrade-python-lxmlubuntu-upgrade-python3-lxml | Dec 21, 2018 | Dec 2, 2018 | |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 2, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub