PyPI/lxml CVE-2021-43818: unknown, EPSS 2.66%
lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content
Action: Upgrade lxml to 4.6.5 or later.
pip install lxml==4.6.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.6.5 | - |
Fixed versions
| 4.6.5 |
Sources
- osv: PYSEC-2021-852
- https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
- https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776
- https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
- https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
CVE-2021-43818 · published · modified · JSON