{"id":"CVE-2020-27783","published":"2020-12-03T16:39:41Z","modified":"2025-12-17T21:02:06Z","title":"A XSS vulnerability was discovered in python-lxml's clean module","vendor":null,"product":null,"tier":"tail","description":{"text":"A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.03982,"percentile":0.90464,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901633","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2020/dsa-4810","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2020-4286","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20210521-0003/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":22.4,"factors":[{"name":"EPSS percentile","points":18.09},{"name":"CVSS severity","points":4.27}]},"affectedVersions":[{"vendor":"n/a","product":"python-lxml","versions":["lxml-4.6.2"]}],"affected":[{"ecosystem":"PyPI","package":"lxml","vulnerableRanges":["<4.6.2",">=1.2, <4.6.2"],"patched":["4.6.2"],"from":["GHSA-pgww-xf46-h92r","PYSEC-2020-62"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0102","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-lxml-cve-2020-27783","children":[{"from":"CVE-2020-27783","to":"CVE-2021-43818","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/lxml/html/clean.py"],"commits":["https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7","https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a","https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c"],"basis":"shared function","functions":["_has_sneaky_javascript"]}]}],"packageHistory":[{"cve":"CVE-2014-3146","published":"2014-05-14","fixed":"3.3.5","kev":false},{"cve":"CVE-2018-19787","published":"2018-12-02","fixed":"4.2.5","kev":false},{"cve":"CVE-2020-27783","published":"2020-12-03","fixed":"4.6.2","kev":false},{"cve":"CVE-2021-28957","published":"2021-03-21","fixed":"4.6.3","kev":false,"link":{"from":"CVE-2020-27783","to":"CVE-2021-28957","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:lxml","fromFixed":"4.6.2","toFixed":"4.6.3","daysApart":108}]}},{"cve":"CVE-2021-43818","published":"2021-12-13","fixed":"4.6.5","kev":false},{"cve":"CVE-2022-2309","published":"2022-07-05","fixed":"4.9.1","kev":false}],"package":"PyPI:lxml"}}