MEDIUM 6.1 Microsoft

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Microsoft Security Update 2021-Mar: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Affected Products

References

Published: 2021-03-09 · Source: Microsoft · Feed updated: 2026-08-20
This medium severity vulnerability with a CVSS score of 6.1 was published on 2021-03-09 via Microsoft. Affected: cm1 python-lxml 4.6.3-1 on CBL Mariner 1.0, cbl2 python-lxml 4.8.0-1 on CBL Mariner 2.0.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.