PT-2026-22701 · Unknown · Lxml Html Clean

Uug4Na · Published 2026-02-27 · Updated 2026-03-26 · CVE-2026-28350

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions lxml html clean versions prior to 0.4.4

Description The software does not properly handle the <base> tag during HTML cleaning. Specifically, the <base> tag is not removed even when page structure=True, which removes html, head, and title tags. This allows an attacker to inject a <base> tag and hijack relative links on the page. Injecting a <base> tag changes the base URL for all relative URLs on the page, including links, images, and scripts, to a domain controlled by the attacker. This can lead to phishing, redirection of form submissions, cross-site scripting (XSS), and defacement of the webpage. The API endpoint is not mentioned. The vulnerable parameter is not mentioned. The vulnerable function is not mentioned.

Recommendations Update to lxml html clean version 0.4.4 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2026-07381

CVE-2026-28350

GHSA-XVP8-3MHV-424C

OPENSUSE-SU-2026:10322-1

OPENSUSE-SU-2026:20345-1

Affected Products

Lxml Html Clean

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28350.json · Exploit
• 🔥 https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-xvp8-3mhv-424c · Exploit
• https://github.com/fedora-python/lxml_html_clean/commit/9c5612ca33b941eec4178abf8a5294b103403f34 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28350 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-28350 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28350 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28350 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10322-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07381 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-28350 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28350 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20345-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xvp8-3mhv-424c · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28350 · Vendor Advisory
• https://github.com/fedora-python/lxml_html_clean · Note