CVE-2020-27783: XSS vulnerability in python-lxml's clean module
Summary
CVE-2020-27783: A XSS vulnerability was discovered in python-lxml's clean module. Affects lxml versions >= 1.2, < 4.6.2. Fixed in 4.6.2. How to fix ↓
Also tracked for
- py3-lxml · Alpine:v3.16
The same CVE-2020-27783 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-lxml is a Python library that provides a Pythonic binding for the C libraries libxml2 and libxslt. It allows developers to work with XML and HTML files, providing a simple and efficient way to parse, manipulate, and generate XML and HTML documents. The clean module within python-lxml is responsible for sanitizing HTML input to prevent cross-site scripting (XSS) attacks.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability was discovered in python-lxml's clean module. The module's parser did not accurately imitate browsers, resulting in different behaviors between the sanitizer and the user's page. This flaw could be exploited by a remote attacker to execute arbitrary HTML/JS code, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Latest published version: 6.1.3 as of 22 Oct 2026
pip install --upgrade "lxml==6.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.6.2
This is the first release that contains the fix.
pip install --upgrade "lxml==4.6.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional input validation and sanitization measures in their code to mitigate the risk of XSS attacks. This can include using security libraries or frameworks that provide robust input sanitization functions.
Conclusion
In conclusion, the python-lxml library's clean module is vulnerable to a cross-site scripting (XSS) attack due to improper browser imitation. Upgrading to version 4.6.2 or later is recommended to fix this vulnerability. In the meantime, developers can implement additional input validation and sanitization measures as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lxml →
FAQ
python-lxml is a Python library that provides a Pythonic binding for the C libraries libxml2 and libxslt. It allows developers to work with XML and HTML files, providing a simple and efficient way to parse, manipulate, and generate XML and HTML documents.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, and other malicious activities.
This vulnerability can be exploited by a remote attacker who can inject specially crafted HTML/JS code into a vulnerable application that uses python-lxml's clean module for input sanitization. When the sanitized input is rendered on the user's page, the injected code will execute within the user's browser, potentially leading to unauthorized actions or data theft.
Yes, the vulnerability can be fixed by upgrading python-lxml to version 4.6.2 or later. This version includes the necessary fixes to properly imitate browsers and ensure consistent behavior between the sanitizer and the user's page.
As a temporary workaround, developers can implement additional input validation and sanitization measures in their code. This can include using security libraries or frameworks that provide robust input sanitization functions.
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
