Cross-Site Scripting Vulnerability in lxml Package: CVE-2014-3146
Summary
CVE-2014-3146: Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html func... Affects lxml versions < 3.3.5-1. Fixed in 3.3.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml is a powerful and feature-rich library in Python used for processing XML and HTML documents. It provides a convenient API for parsing, creating, and manipulating XML and HTML, making it a popular choice among developers. However, prior to version 3.3.5, lxml's html.clean module contained an incomplete blacklist vulnerability that could be exploited for cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3146, stems from an incomplete blacklist in the lxml.html.clean module, which allows remote attackers to conduct XSS attacks. This occurs when control characters are included in the link scheme passed to the clean_html function. If exploited, this vulnerability can lead to unauthorized script execution in the context of the user's browser, potentially compromising sensitive information or user sessions.
How To Fix
Minimum fixed version
3.3.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lxmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing input validation and sanitization on any user-generated content that will be processed by the lxml library. This can help mitigate the risk of XSS attacks until the package can be updated.
Conclusion
CVE-2014-3146 is a critical vulnerability in the lxml package that can lead to serious security risks through XSS attacks. Users are strongly advised to upgrade to version 3.3.5 or later to mitigate these risks. For those unable to upgrade immediately, implementing input validation can serve as a temporary measure.
See every vulnerability recorded for lxml →
FAQ
CVE-2014-3146 is a vulnerability in the lxml package that allows remote attackers to perform cross-site scripting (XSS) attacks via control characters in the link scheme.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute arbitrary scripts in the context of the user's browser, leading to data theft or session hijacking.
Yes, upgrading to lxml version 3.3.5 or later resolves this vulnerability.
Implement input validation and sanitization on user-generated content to reduce the risk of XSS attacks until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
