CVE-2020-27783

2020-12-0316:39:41

CWE-79

redhat

www.cve.org

python-lxml

xss

vulnerability

parser

remote attacker

arbitrary code

AI Score

6.5

Confidence

High

EPSS

0.004

Percentile

73.0%

JSON

A XSS vulnerability was discovered in python-lxml’s clean module. The module’s parser didn’t properly imitate browsers, which caused different behaviors between the sanitizer and the user’s page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

CNA Affected

[
  {
    "product": "python-lxml",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "lxml-4.6.2"
      }
    ]
  }
]