lxml vulnerable to Cross-Site Scripting

中 6.1CVE-2021-28957 · GHSA-jq4v-f5q6-mjqq · PYSEC-2021-19 · 21/03/2021 公開 · 17/06/2026 更新

要点

CVE-2021-28957 は lxml, lxml (lxml), zfs storage appliance kit (oracle) に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：4.0%（全脆弱性の 90.6% より高い）。
対処：4.6.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
lxml PyPI	`< 4.6.3`	`4.6.3`
lxml lxml	`< 4.6.3`	`4.6.3`
zfs storage appliance kit oracle	`= 8.8`	修正版なし

概要

An XSS vulnerability was discovered in the python lxml clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

NVD の説明

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.