CVE-2020-27783: Cross-site Scripting Vulnerability in lxml
Summary
CVE-2020-27783: lxml vulnerable to Cross-site Scripting. Affects lxml versions < 4.6.2. Fixed in 4.6.2. How to fix ↓
Also tracked for
- py3-lxml · Alpine:v3.16
The same CVE-2020-27783 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml is a Python library that provides a powerful and easy-to-use interface for parsing and manipulating XML and HTML documents. It is widely used in various applications for processing XML data. However, a vulnerability has been discovered in lxml's clean module, which is responsible for sanitizing HTML input. This vulnerability allows an attacker to inject arbitrary HTML or JavaScript code into the sanitized output, potentially leading to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the improper imitation of browsers by the parser in the clean module. This results in different behaviors between the sanitizer and the user's page. By exploiting this flaw, a remote attacker can execute arbitrary HTML/JS code within the context of the vulnerable application. This can lead to various consequences, including the theft of sensitive information, session hijacking, or the manipulation of user interfaces.
How To Fix
Latest published version: 6.1.3 as of 22 Oct 2026
pip install --upgrade "lxml==6.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.6.2
This is the first release that contains the fix.
pip install --upgrade "lxml==4.6.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the lxml package is not immediately feasible, a temporary workaround is to implement additional input validation and output encoding in the application code. This can help mitigate the risk of XSS attacks by ensuring that user-supplied input is properly sanitized and encoded before being rendered in HTML pages. Here's an example of how to perform input validation and output encoding in Python:
import lxml.html
def sanitize_input(input):
# Perform input validation
# ...
# Sanitize and encode the input
sanitized_input = lxml.html.clean.clean_html(input)
encoded_input = lxml.html.tostring(sanitized_input, encoding='unicode')
return encoded_input
Note that this is just a basic example, and the specific implementation may vary depending on the application's requirements and framework.
Conclusion
In conclusion, the lxml library is vulnerable to a cross-site scripting (XSS) attack due to a flaw in the clean module's parser. Upgrading to version 4.6.2 or later is the recommended solution to fix this vulnerability. If immediate upgrade is not feasible, implementing input validation and output encoding in the application code can provide temporary mitigation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lxml →
FAQ
The vulnerability allows an attacker to inject malicious HTML or JavaScript code into the sanitized output of the lxml library. This can lead to cross-site scripting (XSS) attacks, potentially compromising the security of the application and its users.
While there is no specific information about known exploits at the moment, it is important to address this vulnerability promptly to prevent potential attacks.
No, only versions prior to 4.6.2 are affected. It is recommended to upgrade to the latest version to mitigate the risk.
Yes, this vulnerability can be exploited remotely by an attacker who can send malicious input to the vulnerable application.
Yes, implementing additional input validation and output encoding in the application code can help mitigate the risk of XSS attacks. However, upgrading to the latest version of lxml is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
