12 matches found
CVE-2026-49825
A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...
CVE-2026-74793
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...
CVE-2026-7808
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...
CVE-2026-7808 justhtml before 1.16.0 Multiple Security Issues via Sanitization
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...
CVE-2026-6827 justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities
justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces SVG/MathML, dangerous content such as HTML integration points SVG , MathML and mutation-XSS parser-differential payloads could...
CVE-2026-74793 justhtml before 3.11.0 XSS via selectedcontent projection
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...
CVE-2026-6827 justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities
justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces SVG/MathML, dangerous content such as HTML integration points SVG , MathML and mutation-XSS parser-differential payloads could...
CVE-2026-6827 justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities
justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces SVG/MathML, dangerous content such as HTML integration points SVG , MathML and mutation-XSS parser-differential payloads could...
Linux Distros Unpatched Vulnerability : CVE-2026-49825
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which...
DEBIAN-CVE-2026-49825
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxmlhtmlclean 0.4...
CVE-2026-49825
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxmlhtmlclean 0.4...