Critical Vulnerability in lxml-html-clean: CSS Escape Sequence Bypass
Summary
DEBIAN-CVE-2026-28348: lxml_html_clean is a project for HTML cleaning functionalities copied from lxml.html.clean. Affects lxml-html-clean versions 0.4.2-1 – 0.4.4-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
lxml-html-clean is a project designed for HTML cleaning functionalities, derived from the lxml.html.clean module. It is widely used in web applications to sanitize HTML content, ensuring that potentially harmful elements are removed. However, prior to version 0.4.4, it contained a significant vulnerability that allowed CSS Unicode escape sequences to bypass security filters, posing a risk for external CSS loading and XSS attacks in older browsers.
Vulnerability Detail
The vulnerability arises from the _has_sneaky_javascript() method, which improperly strips backslashes before evaluating dangerous CSS keywords. This oversight allows attackers to exploit CSS Unicode escape sequences, circumventing the @import and expression() filters. As a result, malicious actors could inject harmful CSS or execute cross-site scripting (XSS) attacks, particularly in older web browsers that do not adequately handle such exploits.
How To Fix
No fixed version is published for this vulnerability.
To rectify this vulnerability, it is essential to update the lxml-html-clean package to version 0.4.4 or later. This can be accomplished by running the following command in your terminal:
sudo apt-get update && sudo apt-get install lxml-html-clean
This will ensure that you are using the patched version that addresses the vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider implementing additional input validation and sanitization on the HTML content before processing it with lxml-html-clean. This can help mitigate the risk of CSS injection until the package is updated.
Conclusion
The lxml-html-clean package has a critical vulnerability that allows CSS escape sequences to bypass security measures, potentially leading to XSS attacks. It is crucial to update to version 0.4.4 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for vulnerabilities in your software dependencies.
See every vulnerability recorded for lxml-html-clean →
FAQ
lxml-html-clean is a library used for cleaning and sanitizing HTML content in web applications.
The vulnerability allows attackers to bypass security filters and potentially inject malicious CSS or execute XSS attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for lxml-html-clean.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.