CVE-2021-28957 - CVE House
Back to Database
Status published Unknown CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions...

Vulnerability Description

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-28957

Credits & Attribution

No credits recorded in the NVD database.

References

More from lxml

View All →
CVE-2022-2309
NULL Pointer Dereference in lxml/lxml
Medium 5.3
CVE-2021-43818
HTML Cleaner allows crafted and SVG embedded scripts to pass through
High 8.2
CVE-2018-19787
An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in...
Unknown 0
CVE-2014-3146
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before...
Unknown 0

Affected Vendor

Affected Software

lxml, debian linux, fedora, snapcenter, zfs storage appliance kit
Vulnerable Versions:
0, 9.0, 10.0, 33, 34, 8.8

Timeline

Official Publish: March 21st, 2021
Last Modified: December 17th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.