CVE-2021-28957: XSS Vulnerability in python-lxml's clean module
Summary
CVE-2021-28957: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. Affects lxml across 2 version ranges.
< 4.6.3
< a5f9cb52079dc57477c460dbe6ba0f775e14a999
Fixed in a5f9cb52079dc57477c460dbe6ba0f775e14a999. How to fix ↓
Also tracked for
- py3-lxml · Alpine:v3.16
The same CVE-2021-28957 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-lxml is a Python library that provides a Pythonic binding for the C libraries libxml2 and libxslt. It allows developers to work with XML and HTML data using a simple and intuitive API. The clean module in python-lxml is responsible for sanitizing HTML input to prevent cross-site scripting (XSS) attacks. However, versions before 4.6.3 of python-lxml's clean module are vulnerable to an XSS attack when the safe_attrs_only and forms arguments are disabled. This vulnerability allows an attacker to bypass the sanitizer and execute arbitrary JavaScript code on users who interact with incorrectly sanitized HTML.
Vulnerability Detail
The XSS vulnerability in python-lxml's clean module arises from a flaw in the Cleaner class. When the safe_attrs_only and forms arguments are disabled, the Cleaner class fails to remove the formaction attribute, which can be exploited by a remote attacker. By injecting malicious code into the formaction attribute, an attacker can execute arbitrary JavaScript code on unsuspecting users' browsers. This can lead to various consequences, such as stealing sensitive information, performing actions on behalf of the user, or redirecting the user to malicious websites.
How To Fix
Latest published version: 6.1.3 as of 22 Oct 2026
pip install --upgrade "lxml==6.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
a5f9cb52079dc57477c460dbe6ba0f775e14a999
This is the first release that contains the fix.
pip install --upgrade "lxml==a5f9cb52079dc57477c460dbe6ba0f775e14a999"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating python-lxml is not immediately feasible, a temporary workaround is to avoid disabling the safe_attrs_only and forms arguments when using the Cleaner class. By keeping these arguments enabled, the vulnerability can be mitigated. Here's an example of how to use the Cleaner class with the safe_attrs_only and forms arguments enabled:
from lxml.html.clean import Cleaner
cleaner = Cleaner(safe_attrs_only=True, forms=True)
# Perform HTML cleaning with the cleaner object
Conclusion
In conclusion, python-lxml's clean module versions before 4.6.3 are vulnerable to an XSS attack when the safe_attrs_only and forms arguments are disabled. This can allow an attacker to execute arbitrary JavaScript code on users who interact with incorrectly sanitized HTML. It is crucial to update python-lxml to version 4.6.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lxml →
FAQ
python-lxml is a Python library that provides a Pythonic binding for the C libraries libxml2 and libxslt. It allows developers to work with XML and HTML data using a simple and intuitive API.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various consequences, such as stealing sensitive information, performing actions on behalf of the user, or redirecting the user to malicious websites.
The XSS vulnerability in python-lxml's clean module occurs when the safe_attrs_only and forms arguments are disabled. This allows the formaction attribute to be included in the sanitized HTML, which can be exploited by an attacker to execute arbitrary JavaScript code on users' browsers.
The potential consequences of this vulnerability include the ability for an attacker to steal sensitive information, perform actions on behalf of the user, or redirect the user to malicious websites. This can lead to unauthorized access, data breaches, and other security risks.
To fix this vulnerability, it is recommended to update python-lxml to version 4.6.3 or later. This version includes the necessary patches to address the XSS vulnerability. You can update python-lxml by running the following command:
pip install --upgrade lxml
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
