Cross-Site Scripting Vulnerability in lxml-html-clean Package
Summary
CVE-2024-52595: lxml_html_clean is a project for HTML cleaning functionalities copied from lxml.html.clean. Affects lxml-html-clean across 2 version ranges.
< 0.4.1-1
< c5d816f86eb3707d72a8ecf5f3823e0daa1b3808
Fixed in 0.4.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml-html-clean is a project that provides HTML cleaning functionalities derived from lxml.html.clean. It is designed to sanitize untrusted HTML content, making it safer for use in web applications. However, prior to version 0.4.0, the package exhibited issues with handling special HTML tags like <svg>, <math>, and <noscript>, which could lead to security vulnerabilities.
Vulnerability Detail
The vulnerability arises from the HTML Parser in lxml, which fails to properly manage context-switching for certain HTML tags. This deviation from standard web browser behavior allows malicious scripts to bypass the cleaning process, potentially leading to Cross-Site Scripting (XSS) attacks. Users relying on lxml-html-clean for sanitizing HTML content may inadvertently expose themselves to security risks if they do not upgrade to the patched version.
How To Fix
Minimum fixed version
0.4.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lxml-html-cleanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can configure lxml-html-clean with specific settings to mitigate the risk. For instance, you can use the following configurations:
remove_tags: Specify tags to remove, moving their content to their parent tags.kill_tags: Specify tags to be completely removed.allow_tags: Restrict the set of permissible tags, excluding context-switching tags like <svg>, <math>, and <noscript>.
Conclusion
The lxml-html-clean package has a significant vulnerability that can lead to XSS attacks due to improper handling of special HTML tags. Users are strongly advised to upgrade to the latest version to ensure their applications remain secure. Temporary workarounds are available for those unable to upgrade immediately.
See every vulnerability recorded for lxml-html-clean →
FAQ
The vulnerability is a Cross-Site Scripting (XSS) issue that allows malicious scripts to bypass the HTML cleaning process.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without needing to sign up.
If exploited, this vulnerability could compromise the security of users by allowing attackers to execute malicious scripts in the context of the application.
Yes, a patch is available in version 0.4.1-1 of lxml-html-clean. Users should upgrade to this version or later.
If an immediate upgrade is not possible, implement the suggested workarounds to mitigate the risk until you can update.
References
Related vulnerabilities
Recent vulnerabilities recorded for lxml-html-clean.
