CVE-2021-28957: lxml vulnerable to Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-21 · updated 2026-06-17
Weakness: CWE-79

Description

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Affected products

Debian Linux: 9.0, 10.0
Fedoraproject Fedora: 33, 34
lxml: before 4.6.3 — fixed in 4.6.3
NetApp SnapCenter: all versions
Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
Pypi Lxml: before 4.6.3; 0.9, 0.9.1, 0.9.2, 1.0.beta, 1.0, 1.0.1 (+140) — fixed in 4.6.3

How to fix

Upgrade to a fixed version: lxml 4.6.3; Pypi Lxml 4.6.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-28957 or the next vulnerability affects your stack