{"action":"Upgrade lxml to 4.2.5 or later.","affected":[{"fixed":"4.2.5","introduced":"0"}],"component":"lxml","cve_ids":["CVE-2018-19787"],"ecosystem":"PyPI","epss":0.02438,"exploited":false,"fixed_versions":["4.2.5"],"ghsa_id":"GHSA-xp26-p53h-6h2p","id":"tcs_01M5KG7S0MD070DMWDHVQ0T025","modified_at":"2023-11-08T04:00:08.560552Z","published_at":"2018-12-02T10:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-12","https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109","https://lists.debian.org/debian-lts-announce/2018/12/msg00001.html","https://usn.ubuntu.com/3841-2/","https://usn.ubuntu.com/3841-1/","https://lists.debian.org/debian-lts-announce/2020/11/msg00044.html","https://github.com/advisories/GHSA-xp26-p53h-6h2p"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2018-12","url":"https://osv.dev/vulnerability/PYSEC-2018-12"}],"summary":"An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as"}