Skip to content
This repository was archived by the owner on Jun 3, 2025. It is now read-only.
This repository was archived by the owner on Jun 3, 2025. It is now read-only.

CVE-2021-28957 (Medium) detected in lxml-4.3.1-cp35-cp35m-manylinux1_x86_64.whl #6

@mend-bolt-for-github

Description

@mend-bolt-for-github

CVE-2021-28957 - Medium Severity Vulnerability

Vulnerable Library - lxml-4.3.1-cp35-cp35m-manylinux1_x86_64.whl

Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.

Library home page: https://files.pythonhosted.org/packages/f4/1c/82d74b4527edca7218cc7d840c8b5e83cb32eacc194e7425fc2f346d4d76/lxml-4.3.1-cp35-cp35m-manylinux1_x86_64.whl

Dependency Hierarchy:

  • lxml-4.3.1-cp35-cp35m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: d18505a648a05289a7aac926f14f8b2cf6b2c4e9

Found in base branch: master

Vulnerability Details

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Publish Date: 2021-03-21

URL: CVE-2021-28957

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jq4v-f5q6-mjqq

Release Date: 2021-03-21

Fix Resolution: 4.6.2


Step up your Open Source Security Game with Mend here

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions