{"id":"CVE-2021-28957","published":"2021-03-21T04:39:35Z","modified":"2025-12-17T21:31:43Z","title":"An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3","vendor":null,"product":null,"tier":"tail","description":{"text":"An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.04035,"percentile":0.90578,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://bugs.launchpad.net/lxml/+bug/1888153","tags":["x_refsource_MISC"]},{"url":"https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2021/dsa-4880","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC"]},{"url":"https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20210521-0004/","tags":["x_refsource_CONFIRM"]},{"url":"https://security.gentoo.org/glsa/202208-06","tags":["vendor-advisory","x_refsource_GENTOO"]}],"priority":{"score":22.4,"factors":[{"name":"EPSS percentile","points":18.12},{"name":"CVSS severity","points":4.27}]},"affected":[{"ecosystem":"PyPI","package":"lxml","vulnerableRanges":["<4.6.3"],"patched":["4.6.3"],"from":["GHSA-jq4v-f5q6-mjqq","PYSEC-2021-19"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0116","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-lxml-cve-2020-27783","children":[{"from":"CVE-2021-28957","to":"CVE-2021-43818","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:lxml","fromFixed":"4.6.3","toFixed":"4.6.5","daysApart":267},{"kind":"same-code","provenance":"machine","files":["src/lxml/__init__.py"],"commits":["https://github.com/lxml/lxml/commit/10ec1b4e9f93713513a3264ed6158af22492f270","https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999","https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a","https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2014-3146","published":"2014-05-14","fixed":"3.3.5","kev":false},{"cve":"CVE-2018-19787","published":"2018-12-02","fixed":"4.2.5","kev":false},{"cve":"CVE-2020-27783","published":"2020-12-03","fixed":"4.6.2","kev":false,"link":{"from":"CVE-2020-27783","to":"CVE-2021-28957","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:lxml","fromFixed":"4.6.2","toFixed":"4.6.3","daysApart":108}]}},{"cve":"CVE-2021-28957","published":"2021-03-21","fixed":"4.6.3","kev":false},{"cve":"CVE-2021-43818","published":"2021-12-13","fixed":"4.6.5","kev":false},{"cve":"CVE-2022-2309","published":"2022-07-05","fixed":"4.9.1","kev":false},{"cve":"CVE-2026-41066","published":"2026-04-24","fixed":"6.1.0","kev":false}],"package":"PyPI:lxml"}}