XSS Vulnerability in lxml Package: Escaped JavaScript URLs Not Removed
Summary
CVE-2018-19787: An issue was discovered in lxml before 4.2.5. Affects lxml across 2 version ranges.
< 4.2.5-1
< 6be1d081b49c97cfd7b3fbd934a193b668629109
Fixed in 4.2.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml is a powerful and feature-rich library in Python used for processing XML and HTML documents. It provides a convenient API for parsing and creating XML and HTML, making it a popular choice among developers for web scraping, data manipulation, and more. However, prior to version 4.2.5, lxml had a vulnerability in its html.clean module that failed to adequately sanitize certain JavaScript URLs, exposing applications to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
An issue was discovered in lxml before version 4.2.5, specifically in the lxml/html/clean.py file. The vulnerability arises from the module's inability to remove JavaScript URLs that utilize escaping techniques, such as 'j a v a s c r i p t:'. This flaw allows remote attackers to conduct XSS attacks, which can lead to unauthorized actions being performed on behalf of users or the exposure of sensitive information. This vulnerability is similar to CVE-2014-3146 and has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.2.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lxmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround involves manually sanitizing input to ensure that any JavaScript URLs are removed or encoded before processing. For example, you can implement a function to filter out such URLs:
import re
def sanitize_input(input_string):
return re.sub(r'javascript:[^\s]*', '', input_string)
This function can be used to clean user inputs before they are processed by the lxml library.
Conclusion
The lxml package has a significant vulnerability that allows for XSS attacks due to improper handling of escaped JavaScript URLs. It is crucial for users to upgrade to version 4.2.5 or later to mitigate this risk. Implementing input sanitization can serve as a temporary workaround until an upgrade is feasible.
See every vulnerability recorded for lxml →
FAQ
The vulnerability allows attackers to inject malicious JavaScript code into web applications, potentially leading to data theft, session hijacking, or other unauthorized actions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions of lxml prior to 4.2.5 are affected by this vulnerability.
Yes, you can implement input sanitization to filter out JavaScript URLs as a temporary measure until you can upgrade.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
