Lucene search
+L

106 matches found

PyPA
PyPA
•added 2026/07/13 3:46 p.m.•49 views

`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

lxmlhtmlclean.Cleaner does not strip javascript: URLs from namespaced URL attributes xlink:hrefReporter: Guillem Lefait · Date: 2026-05-10Affected: lxml ≤ 6.1.0 and lxmlhtmlclean ≤ 0.4.4 latest stableConfirmed against: lxml 6.1.0 + lxmlhtmlclean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 libxml...

8.2CVSS7.1AI score0.00297EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder