CVE-2021-43818: Vulnerability in lxml - Crafted and SVG Embedded Scripts Bypass HTML Cleaner
Summary
CVE-2021-43818: lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through. Affects lxml versions < 4.6.5. Fixed in 4.6.5. How to fix ↓
Also tracked for
- py3-lxml · Alpine:v3.16
The same CVE-2021-43818 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml is a Python library that provides a powerful and easy-to-use interface for parsing and manipulating XML and HTML documents. It is widely used for web scraping, data extraction, and XML processing tasks. The HTML Cleaner module in lxml is designed to sanitize HTML content by removing potentially malicious or unsafe elements and attributes. However, a vulnerability has been discovered in lxml's HTML Cleaner that allows certain crafted script content and script content in SVG files embedded using data URIs to bypass the cleaning process.
Vulnerability Detail
The vulnerability in lxml's HTML Cleaner allows crafted script content to pass through the cleaning process, potentially leading to cross-site scripting (XSS) attacks. Additionally, script content in SVG files embedded using data URIs can also bypass the cleaning process, further increasing the risk of XSS attacks. This vulnerability can be exploited by an attacker to inject malicious scripts into web pages, compromising the security and integrity of the affected application. The issue has been assigned a CVSS score of 8.2, indicating a high severity level.
How To Fix
Latest published version: 6.1.3 as of 22 Oct 2026
pip install --upgrade "lxml==6.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.6.5
This is the first release that contains the fix.
pip install --upgrade "lxml==4.6.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of lxml as soon as possible.
Conclusion
The vulnerability in lxml's HTML Cleaner allows crafted and SVG embedded scripts to bypass the cleaning process, potentially leading to cross-site scripting (XSS) attacks. Users should upgrade to lxml version 4.6.5 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lxml →
FAQ
lxml is a Python library for parsing and manipulating XML and HTML documents. It is commonly used for web scraping and data extraction tasks.
The HTML Cleaner module in lxml is responsible for sanitizing HTML content by removing potentially malicious or unsafe elements and attributes.
This vulnerability allows crafted script content and script content in SVG files embedded using data URIs to bypass the HTML cleaning process, potentially leading to cross-site scripting (XSS) attacks.
To fix this vulnerability, you should upgrade to lxml version 4.6.5 or later. This version includes a fix for the HTML Cleaner module that properly sanitizes script content.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of lxml.
References
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
