elifearticle (0.1.1), elifedbtools (0.0.1) +1 more potentially affected by CVE-2021-28957 via lxml (3.4.1)

lxml PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - elifearticle 0.1.1 - elifedbtools 0.0.1 - elifetools =0.1.2, =0.1.7 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

appngizer (>=1.14.1, <=1.15.0), qixnat (>=2.1.2, <=2.1.3) +1 more potentially affected by CVE-2021-28957 via lxml (3.4.0)

lxml PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - appngizer =1.14.1, =2.1.2, =0.1.0, =0.2.5 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

adamalib (0.1.0), bormeparser (>=0.1.1, <=0.2.3) +23 more potentially affected by CVE-2021-28957 via lxml (3.4.4)

lxml PYPI version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - adamalib 0.1.0 - bormeparser =0.1.1, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =1.0.1, =2.0.2.16012810, =2.0.1.15101417, =2.0.1.15101417,...

django-transcribe (>=0.3.5, <=0.5.17), odooku-odoo-account-invoicing (>=11.0.0, <=11.0.6) +35 more potentially affected by CVE-2021-28957 via lxml (3.5.0)

lxml PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - django-transcribe =0.3.5, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0,...

allen-bradley-toolkit (>=1.0.0a1.post0, <=1.3.0a1.post1), coala-bears (>=0.12.0.dev20170531025553, <=0.12.0.dev20170719125022) +10 more potentially affected by CVE-2021-28957 via lxml (3.6.0)

lxml PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - allen-bradley-toolkit =1.0.0a1.post0, =0.12.0.dev20170531025553, =0.0.0, =0.18.1, =0.9.0, =0.6.3, =4.0.0, =4.3.0 - tml 0.3.1 Source cves: CVE-2021-28957...

bormeparser (0.2.4), bsxprinter (>=0.2.0, <=0.4.0) +16 more potentially affected by CVE-2021-28957 via lxml (3.6.4)

lxml PYPI version 3.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bormeparser 0.2.4 - bsxprinter =0.2.0, =0.1.0, =0.1.1, =0.6.12a2, =1.5.9, =0.1.1, =0.1.3 and more Source cves: CVE-2021-28957 Source advisory:...

eemeter (>=0.4.9, <=0.5.11), nginxauthdaemon (>=1.0.0a1, <=1.1.0) +1 more potentially affected by CVE-2021-28957 via lxml (3.6.1)

lxml PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - eemeter =0.4.9, =1.0.0a1, =1.1.0 - rrtop100 0.1.0 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

no-cloud (0.0.8), okami (0.1.0) potentially affected by CVE-2021-28957 via lxml (3.7.1)

lxml PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - no-cloud 0.0.8 - okami 0.1.0 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

beu (>=0.1.0, <=0.1.1), c2cwsgiutils (>=0.2.0, <=0.3.2) +3 more potentially affected by CVE-2021-28957 via lxml (3.7.2)

lxml PYPI version 3.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - beu =0.1.0, =0.2.0, =0.1.0, =0.1.1, =0.1.3 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

bioc (>=1.1.0.dev1, <=1.1.0.dev2), biweeklybudget (>=0.1.0, <=0.7.0) +13 more potentially affected by CVE-2021-28957 via lxml (3.7.3)

lxml PYPI version 3.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bioc =1.1.0.dev1, =0.1.0, =0.3.3, =1.1.3.0, =0.6.14, =1.0.0, =0.1.4, =0.1.5 - pyodata 1.1.1 - readembedability 1.6.0 - sfmc 0.1.2 - sirbot-plugins 0.1.2...

alo7-airflow (>=1.10.0, <=1.10.0.7), c2cwsgiutils (>=0.14.0, <=0.27.0) +44 more potentially affected by CVE-2021-28957 via lxml (3.8.0)

lxml PYPI version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - alo7-airflow =1.10.0, =0.14.0, =0.0.1, =0.2.2, =1.0.0, =3.0.4, =0.0.0a3, =0.8.4, =0.1.4, =0.0.13, =0.0.0, =0.0.2, =1.0.0a2, =1.0.0a8 and more Source cve...

a3m (0.1.0), acdh-collatex-utils (>=0.2.0, <=1.3.0) +452 more potentially affected by CVE-2021-28957 via lxml (>=4.0.0, <=4.6.2)

lxml PYPI version =4.0.0, =0.2.0, =1.0.0rc1, =3.0.0, =0.1.0, =0.1.16, =0.7.2, =1.0.1, =1.0.0, =1.1.15, =0.0.5.dev412, =0.0.5.dev432 and more Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

GHSA-JQ4V-F5Q6-MJQQ lxml vulnerable to Cross-Site Scripting

An XSS vulnerability was discovered in the python lxml clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

document-clipper (>=0.9.0, <=0.13.6) potentially affected by CVE-2021-28957 via lxml (3.3.2)

lxml PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - document-clipper =0.9.0, =0.13.6 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

doc2dash (1.2.0) potentially affected by CVE-2021-28957 via lxml (3.2.3)

lxml PYPI version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - doc2dash 1.2.0 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

rymtracks (0.1.2) potentially affected by CVE-2021-28957 via lxml (3.3.0)

lxml PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - rymtracks 0.1.2 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

chopper (>=0.4.7, <=0.4.8), doc2dash (>=1.2.1, <=2.0.2) potentially affected by CVE-2021-28957 via lxml (3.3.5)

lxml PYPI version 3.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - chopper =0.4.7, =1.2.1, =2.0.2 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

reahl-webdev (>=3.1.0, <=3.2.0) potentially affected by CVE-2021-28957 via lxml (3.3.6)

lxml PYPI version 3.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - reahl-webdev =3.1.0, =3.2.0 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

epcpyyes (>=1.0.13, <=1.2.0) potentially affected by CVE-2021-28957 via lxml (3.7.0)

lxml PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - epcpyyes =1.0.13, =1.2.0 Source cves: CVE-2021-28957 Source advisory: OSV:GHSA-JQ4V-F5Q6-MJQQ...

CVE-2021-28957

A flaw was found in python-lxml. The HTML5 formaction attribute is not input sanitized like the HTML action attribute is which can lead to a Cross-Site Scripting attack XSS when an application uses python-lxml to sanitize user inputs. The highest threat from this vulnerability is to data...