Cross-site Scripting (XSS)

lxml is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary script via HTML action attribute into defs.linkattrs in html/defs.py...

AZL-6808 CVE-2021-28957 affecting package python-lxml for versions less than 4.8.0-1

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

ALPINE-CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

DEBIAN-CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

reahl-webdev (>=3.1.0, <=3.2.0) potentially affected by CVE-2021-28957 via lxml (3.3.6)

lxml PYPI version 3.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - reahl-webdev =3.1.0, =3.2.0 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

elifearticle (0.1.1), elifedbtools (0.0.1) +1 more potentially affected by CVE-2021-28957 via lxml (3.4.1)

lxml PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - elifearticle 0.1.1 - elifedbtools 0.0.1 - elifetools =0.1.2, =0.1.7 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

rymtracks (0.1.2) potentially affected by CVE-2021-28957 via lxml (3.3.0)

lxml PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - rymtracks 0.1.2 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

doc2dash (1.2.0) potentially affected by CVE-2021-28957 via lxml (3.2.3)

lxml PYPI version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - doc2dash 1.2.0 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

appngizer (>=1.14.1, <=1.15.0), qixnat (>=2.1.2, <=2.1.3) +1 more potentially affected by CVE-2021-28957 via lxml (3.4.0)

lxml PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - appngizer =1.14.1, =2.1.2, =0.1.0, =0.2.5 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

alo7-airflow (>=1.10.0, <=1.10.0.7), c2cwsgiutils (>=0.14.0, <=0.27.0) +44 more potentially affected by CVE-2021-28957 via lxml (3.8.0)

lxml PYPI version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - alo7-airflow =1.10.0, =0.14.0, =0.0.1, =0.2.2, =1.0.0, =3.0.4, =0.0.0a3, =0.8.4, =0.1.4, =0.0.13, =0.0.0, =0.0.2, =1.0.0a2, =1.0.0a8 and more Source cve...

chopper (>=0.4.7, <=0.4.8), doc2dash (>=1.2.1, <=2.0.2) potentially affected by CVE-2021-28957 via lxml (3.3.5)

lxml PYPI version 3.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - chopper =0.4.7, =1.2.1, =2.0.2 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

a3m (0.1.0), acdh-collatex-utils (>=0.2.0, <=1.3.0) +452 more potentially affected by CVE-2021-28957 via lxml (>=4.0.0, <=4.6.2)

lxml PYPI version =4.0.0, =0.2.0, =1.0.0rc1, =3.0.0, =0.1.0, =0.1.16, =0.7.2, =1.0.1, =1.0.0, =1.1.15, =0.0.5.dev412, =0.0.5.dev432 and more Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

allen-bradley-toolkit (>=1.0.0a1.post0, <=1.3.0a1.post1), coala-bears (>=0.12.0.dev20170531025553, <=0.12.0.dev20170719125022) +10 more potentially affected by CVE-2021-28957 via lxml (3.6.0)

lxml PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - allen-bradley-toolkit =1.0.0a1.post0, =0.12.0.dev20170531025553, =0.0.0, =0.18.1, =0.9.0, =0.6.3, =4.0.0, =4.3.0 - tml 0.3.1 Source cves: CVE-2021-28957...

document-clipper (>=0.9.0, <=0.13.6) potentially affected by CVE-2021-28957 via lxml (3.3.2)

lxml PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - document-clipper =0.9.0, =0.13.6 Source cves: CVE-2021-28957 Source advisory: OSV:PYSEC-2021-19...

PYSEC-2021-19

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

UBUNTU-CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

Cross site scripting

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...