CVE-2026-28348

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.4, the hassneakyjavascript method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression filters,...

CVE-2026-28348 lxml_html_clean: CSS @import Filter Bypass via Unicode Escapes

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.4, the hassneakyjavascript method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression filters,...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28348 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =1.0.1 and more Source cves: CVE-2026-28348 Source advisory: MEND:CVE-2026-28348...

lxml-html-clean has <base> tag injection through default Cleaner configuration

Summary The tag passes through the default Cleaner configuration. While pagestructure=True removes html, head, and title tags, there is no specific handling for , allowing an attacker to inject it and hijack relative links on the page. Details The tag is not currently in the pagestructure kill se...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28350 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =1.0.1 and more Source cves: CVE-2026-28350 Source advisory: GHSA-XVP8-3MHV-424C...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28350 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =1.0.1 and more Source cves: CVE-2026-28350 Source advisory: OSV:GHSA-XVP8-3MHV-424C...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28350 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =1.0.1 and more Source cves: CVE-2026-28350 Source advisory: SNYK:PYTHON-LXMLHTMLCLEAN-15369131...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28348 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =1.0.1 and more Source cves: CVE-2026-28348 Source advisory: OSV:GHSA-HW26-MMPG-FQFG...

lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes

Summary The hassneakyjavascript method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression filters, allowing external CSS loading or XSS in older browsers. Details The root cause is located in clean.py around...

Improper Encoding or Escaping of Output

Overview lxml-html-clean is a HTML cleaner from lxml project Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the hassneakyjavascript function. An attacker can cause external CSS to be loaded or execute scripts in certain browsers by injecting special...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28348 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =1.0.1 and more Source cves: CVE-2026-28348 Source advisory: SNYK:PYTHON-LXMLHTMLCLEAN-15369490...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28348 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =1.0.1 and more Source cves: CVE-2026-28348 Source advisory: GHSA-HW26-MMPG-FQFG...

PT-2026-22701

Name of the Vulnerable Software and Affected Versions lxml html clean versions prior to 0.4.4 Description The software does not properly handle the tag during HTML cleaning. Specifically, the tag is not removed even when page structure=True, which removes html, head, and title tags. This allows a...

Linux Distros Unpatched Vulnerability : CVE-2024-52595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.0, the HTML Parser in lxml does not properly hand...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +20 more potentially affected by CVE-2024-52595 via lxml-html-clean (>=0.1.0, <=0.3.1)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =0.1.0, =0.1.0, =1.10.0, =0.0.4, =0.0.7 and more Source cves: CVE-2024-52595 Source advisory: OSV:PYSEC-2024-160...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +20 more potentially affected by CVE-2024-52595 via lxml-html-clean (>=0.1.0, <=0.3.1)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =0.1.0, =0.1.0, =1.10.0, =0.0.4, =0.0.7 and more Source cves: CVE-2024-52595 Source advisory: MEND:CVE-2024-52595...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +20 more potentially affected by CVE-2024-52595 via lxml-html-clean (>=0.1.0, <=0.3.1)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =0.1.0, =0.1.0, =1.10.0, =0.0.4, =0.0.7 and more Source cves: CVE-2024-52595 Source advisory: OSV:GHSA-5JFW-GQ64-Q45F...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +20 more potentially affected by CVE-2024-52595 via lxml-html-clean (>=0.1.0, <=0.3.1)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =0.1.0, =0.1.0, =1.10.0, =0.0.4, =0.0.7 and more Source cves: CVE-2024-52595 Source advisory: SNYK:PYTHON-LXMLHTMLCLEAN-8399905...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +20 more potentially affected by CVE-2024-52595 via lxml-html-clean (>=0.1.0, <=0.3.1)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.6.0, =0.2.0, =12.0.15, =1.0.0, =0.1.0, =0.1.0, =1.10.0, =0.0.4, =0.0.7 and more Source cves: CVE-2024-52595 Source advisory: GHSA-5JFW-GQ64-Q45F...

lxml_html_clean security vulnerability

lxmlhtmlclean is a separate project of the Fedora Python SIG open source HTML cleanup function copied from lxml.HTML.clean. A security vulnerability exists in versions of lxmlhtmlclean prior to 0.4.0, which stems from improper handling of special tags and is vulnerable to cross-site scripting...