What’s Vulnerable › Vulnerabilities

CVE-2021-43818: HTML Cleaner allows crafted and SVG embedded scripts to pass through

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-13 · updated 2026-06-17
• Weakness: CWE-74

Description

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

Affected products

• Debian Linux: 9.0, 10.0, 11.0
• Fedoraproject Fedora: 34, 35
• lxml: before 4.6.5 — fixed in 4.6.5
• NetApp Hci Storage Node Firmware: all versions
• NetApp Solidfire: all versions
• NetApp Solidfire Enterprise Sds: all versions
• Oracle Communications Cloud Native Core Binding Support Function: 22.1.3
• Oracle Communications Cloud Native Core Network Exposure Function: 22.1.1
• Oracle Communications Cloud Native Core Policy: 22.2.0
• Oracle Corporation Oracle HTTP Server: 12.2.1.3.0, 12.2.1.4.0
• Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
• Pypi Lxml: before 4.6.5; 0.9, 0.9.1, 0.9.2, 1.0, 1.0.1, 1.0.2 (+142) — fixed in 4.6.5

How to fix

Upgrade to a fixed version: lxml 4.6.5; Pypi Lxml 4.6.5. Check the vendor advisory for mitigations.

References

• https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
• https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776
• https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
• https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
• https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44/
• https://security.gentoo.org/glsa/202208-06
• https://security.netapp.com/advisory/ntap-20220107-0005/
• https://www.debian.org/security/2022/dsa-5043

Get alerted when CVE-2021-43818 or the next vulnerability affects your stack