CVEvulnerability

CVE-2021-43818

7.1 HIGH Published 2021-12-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-12-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-74, CWE-79

Description

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

Affected configurations

• lxml lxml (< 4.6.5) • fedoraproject fedora 34 • fedoraproject fedora 35 • debian debian linux 9.0 • debian debian linux 10.0 • debian debian linux 11.0 • netapp solidfire • netapp solidfire enterprise sds • netapp hci storage node firmware • oracle communications cloud native core binding support function 22.1.3 • oracle communications cloud native core network exposure function 22.1.1 • oracle communications cloud native core policy 22.2.0 • oracle http server 12.2.1.3.0 • oracle http server 12.2.1.4.0 • oracle zfs storage appliance kit 8.8

Related

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References