OESA-2026-3217 python-lxml security update

\ Security Fixes: lxmlhtmlclean.Cleaner does not strip javascript: URLs from namespaced URL attributes xlink:href. The vulnerability exists because Cleaner filters URL schemes by walking links via rewritelinks, which delegates to iterlinks, which only yields attributes named in...

Updated python-lxml packages fix a security vulnerability

An XSS vulnerability was discovered in python-lxml’s clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...