PT-2014-1801 · Lxml+2 · Lxml+2
Максим Кочкин
·
Published
2014-05-14
·
Updated
2025-12-18
·
CVE-2014-3146
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
lxml versions prior to 3.3.5
Description
The issue is related to an incomplete blacklist vulnerability in the
lxml.html.clean module, which allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean html function. This can lead to a violation of the integrity of protected information. The exploitation of this vulnerability can be carried out remotely.Recommendations
For versions prior to 3.3.5, update to version 3.3.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
lxml.html.clean module until a patch is available. Avoid using the clean html function in the affected module to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Ubuntu
Lxml