CVE-2021-28957

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-28957
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-28957.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-28957
Aliases
Downstream
ALPINE (1)
ALSA (4)
AZL (1)
BELL (1)
CLEANSTART (1)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (4)
RHSA (5)
RLSA (4)
SUSE (9)
UBUNTU (1)
Related
ALSA (4)
openSUSE (4)
SUSE (9)
Published
2021-03-21T05:15:13Z
Modified
2026-10-16T02:50:01Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "9.0"
                        },
                        {
                            "last_affected": "9.0"
                        },
                        {
                            "introduced": "10.0"
                        },
                        {
                            "last_affected": "10.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "debian:debian_linux"
        },
        {
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "33"
                        },
                        {
                            "last_affected": "33"
                        },
                        {
                            "introduced": "34"
                        },
                        {
                            "last_affected": "34"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "fedoraproject:fedora"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.8"
                        },
                        {
                            "last_affected": "8.8"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "oracle:zfs_storage_appliance_kit"
        }
    ]
}
References

Affected packages

Git / github.com/lxml/lxml

Affected ranges

Type
GIT
Repo
https://github.com/lxml/lxml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a5f9cb52079dc57477c460dbe6ba0f775e14a999
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "4.6.3"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "a5f9cb52079dc57477c460dbe6ba0f775e14a999"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

lxml-0.*
lxml-0.5.1
lxml-0.6
lxml-0.7
lxml-0.9
lxml-1.*
lxml-1.0
lxml-1.0.beta
lxml-1.1
lxml-1.1alpha
lxml-1.1beta
lxml-1.2
lxml-2.*
lxml-2.0
lxml-2.0.1
lxml-2.0alpha1
lxml-2.0alpha2
lxml-2.0alpha3
lxml-2.0alpha4
lxml-2.0alpha5
lxml-2.0alpha6
lxml-2.0beta1
lxml-2.0beta2
lxml-2.1
lxml-2.1alpha1
lxml-2.1beta1
lxml-2.1beta2
lxml-2.1beta3
lxml-2.2
lxml-2.2.1
lxml-2.2.2
lxml-2.3
lxml-2.3.1
lxml-2.3alpha1
lxml-2.3alpha2
lxml-2.3beta1
lxml-3.*
lxml-3.0
lxml-3.0.1
lxml-3.0alpha1
lxml-3.0alpha2
lxml-3.0beta1
lxml-3.1.0
lxml-3.1.1
lxml-3.1beta1
lxml-3.2.0
lxml-3.2.1
lxml-3.2.2
lxml-3.2.3
lxml-3.3.0
lxml-3.3.0beta1
lxml-3.3.0beta2
lxml-3.3.0beta3
lxml-3.3.0beta4
lxml-3.3.0beta5
lxml-3.3.1
lxml-3.3.2
lxml-3.3.3
lxml-3.4.0
lxml-3.4.0beta1
lxml-3.4.1
lxml-3.5.0
lxml-3.5.0b1
lxml-3.6.0
lxml-3.6.1
lxml-3.7.0
lxml-3.7.1
lxml-3.7.2
lxml-3.8.0
lxml-3.8.0-py27fix
lxml-4.*
lxml-4.0.0
lxml-4.1.0
lxml-4.1.1
lxml-4.2.0
lxml-4.2.1
lxml-4.2.2
lxml-4.3.0
lxml-4.3.1
lxml-4.3.2
lxml-4.4.0
lxml-4.4.1
lxml-4.5.0
lxml-4.5.1
lxml-4.5.2
lxml-4.6.0
lxml-4.6.1
lxml-4.6.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-28957.json"