HTML Injection Vulnerability in lxml-html-clean Package
Summary
DEBIAN-CVE-2026-28350: lxml_html_clean is a project for HTML cleaning functionalities copied from lxml.html.clean. Affects lxml-html-clean versions 0.4.2-1 – 0.4.4-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml-html-clean is a project designed for HTML cleaning functionalities, derived from the lxml.html.clean module. It is commonly used in web applications to sanitize HTML content, ensuring that only safe and valid HTML is processed. However, prior to version 0.4.4, the package had a significant security flaw that allowed attackers to exploit the <base> tag, potentially compromising the integrity of web pages.
Vulnerability Detail
The vulnerability arises from the default Cleaner configuration in lxml-html-clean, which allows the <base> tag to pass through without specific handling. Although the configuration removes certain tags like html, head, and title when page_structure=True is set, it does not address the <base> tag. This oversight enables attackers to inject malicious <base> tags, which can hijack relative links on the page, leading to phishing attacks or redirecting users to harmful sites.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can manually sanitize any <base> tags in your HTML content before processing it with lxml-html-clean. This can be done by removing or validating the <base> tag to ensure it does not contain malicious URLs.
Conclusion
The lxml-html-clean package has a critical vulnerability that allows for HTML injection through the <base> tag. It is crucial to update to version 0.4.4 or later to protect against potential attacks. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for lxml-html-clean →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a medium severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability can lead to phishing attacks, where users are redirected to malicious sites, compromising their sensitive information.
While updating is the best solution, you can implement manual sanitization of HTML content as a temporary measure to mitigate risks.
Detailed information about this vulnerability can be found in the official CVE database and security advisories related to lxml-html-clean.
References
Related vulnerabilities
Recent vulnerabilities recorded for lxml-html-clean.
