CVE-2018-19787: XSS Vulnerability in lxml
Summary
CVE-2018-19787: An issue was discovered in lxml before 4.2.5. Affects lxml across 2 version ranges.
< 4.2.5
< 6be1d081b49c97cfd7b3fbd934a193b668629109
Fixed in 6be1d081b49c97cfd7b3fbd934a193b668629109. How to fix ↓
Also tracked for
- lxml · Debian:11
The same CVE-2018-19787 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml is a Python library that provides a powerful and easy-to-use interface for parsing and manipulating XML and HTML documents. It is widely used in various applications for processing XML and HTML data. However, versions before 4.2.5 of lxml are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability exists in the lxml.html.clean module, specifically in the clean.py file. The module fails to remove javascript: URLs that use escaping, allowing an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various malicious activities, such as stealing sensitive information, session hijacking, or defacement of web pages. The vulnerability is similar to CVE-2014-3146.
How To Fix
Latest published version: 6.1.3 as of 22 Oct 2026
pip install --upgrade "lxml==6.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6be1d081b49c97cfd7b3fbd934a193b668629109
This is the first release that contains the fix.
pip install --upgrade "lxml==6be1d081b49c97cfd7b3fbd934a193b668629109"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually sanitize and validate any user-generated HTML content to remove or neutralize any potentially malicious JavaScript code. This can be done using HTML sanitization libraries or custom code that follows best practices for preventing XSS attacks.
Conclusion
The XSS vulnerability in lxml before version 4.2.5 can be exploited by attackers to execute arbitrary JavaScript code in the context of a victim's browser. Upgrading to the latest version of lxml or implementing proper input validation and sanitization practices are recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lxml →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser, potentially leading to sensitive information theft, session hijacking, or website defacement.
Versions of lxml before 4.2.5 are affected by this vulnerability.
While there may not be a publicly known exploit at the moment, the vulnerability has the potential to be exploited by attackers.
The recommended mitigation is to upgrade lxml to version 4.2.5 or later. Additionally, implementing proper input validation and sanitization practices can help prevent XSS attacks.
Yes, this vulnerability is identified as CVE-2018-19787.
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
