106 matches found
`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes
lxmlhtmlclean.Cleaner does not strip javascript: URLs from namespaced URL attributes xlink:hrefReporter: Guillem Lefait · Date: 2026-05-10Affected: lxml ≤ 6.1.0 and lxmlhtmlclean ≤ 0.4.4 latest stableConfirmed against: lxml 6.1.0 + lxmlhtmlclean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 libxml...
8.2CVSS7.1AI score0.00297EPSS
SaveExploits0References5Affected Software1
20