PyPI/lxml-html-clean CVE-2026-28348: medium 6.1, EPSS 0.28%

lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes

Action: Upgrade lxml-html-clean to 0.4.4 or later.

pip install lxml-html-clean==0.4.4

Affected

Fixed versions

Sources

• osv: GHSA-hw26-mmpg-fqfg
• https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-hw26-mmpg-fqfg
• https://nvd.nist.gov/vuln/detail/CVE-2026-28348
• https://github.com/fedora-python/lxml_html_clean/commit/2ef732667ddbc74ea59847bcf24b75809aaeed3b
• https://github.com/fedora-python/lxml_html_clean

CVE-2026-28348 · published 2026-03-02T19:19:15Z · modified 2026-09-10T03:50:39.674211658Z · JSON