PT-2018-2954 · Lxml+2 · Lxml+2
Publicado
2018-12-02
·
Atualizado
2025-12-18
·
CVE-2018-19787
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
lxml versions prior to 4.2.5
Description
The issue is related to the lxml.html.clean module in the lxml library, which fails to remove javascript: URLs that use escaping. This allows a remote attacker to conduct cross-site scripting (XSS) attacks. The vulnerability can be exploited by using specially crafted URLs, such as "j a v a s c r i p t:" in Internet Explorer.
Recommendations
For versions prior to 4.2.5, update to version 4.2.5 or later to resolve the issue.
As a temporary workaround, consider disabling the use of the
lxml.html.clean module until a patch is available.
Restrict access to the lxml/html/clean.py component to minimize the risk of exploitation.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Suse
Ubuntu
Lxml