CVE-2014-3146: lxml Cross-site Scripting Via Control Characters
Summary
CVE-2014-3146: lxml Cross-site Scripting Via Control Characters. Affects lxml versions < 3.3.5. Fixed in 3.3.5. How to fix ↓
Also tracked for
- lxml · Debian:11
The same CVE-2014-3146 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml is a Python library that provides a powerful and easy-to-use interface for parsing and manipulating XML and HTML documents. It is widely used in various applications for processing XML and HTML data. However, versions of lxml before 3.3.5 are vulnerable to a cross-site scripting (XSS) attack due to an incomplete blacklist in the lxml.html.clean module. This vulnerability allows remote attackers to inject malicious scripts into web pages by exploiting control characters in the link scheme passed to the clean_html function.
Vulnerability Detail
The vulnerability in lxml arises from a lack of proper input validation and sanitization in the clean_html function. By using control characters in the link scheme, an attacker can bypass the input sanitization and inject arbitrary scripts into web pages. This can lead to various security issues, including session hijacking, defacement of web pages, and theft of sensitive information. The vulnerability has a moderate severity rating and is classified under CWE-79 (Cross-Site Scripting).
How To Fix
Latest published version: 6.1.3 as of 22 Oct 2026
pip install --upgrade "lxml==6.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.5
This is the first release that contains the fix.
pip install --upgrade "lxml==3.3.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of lxml is not feasible, a temporary workaround is to implement additional input validation and sanitization measures in the affected code. This can involve using a robust HTML sanitizer or custom validation functions to ensure that the link scheme does not contain any control characters or malicious scripts. However, it is strongly recommended to update to the latest version of lxml as soon as possible to fully address the vulnerability.
Conclusion
The vulnerability in lxml before version 3.3.5 allows for cross-site scripting attacks through control characters in the link scheme. To mitigate this vulnerability, it is crucial to update to the latest version of lxml. If upgrading is not immediately possible, implementing additional input validation and sanitization measures can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lxml →
FAQ
lxml is a Python library for processing XML and HTML documents.
The vulnerability allows remote attackers to inject malicious scripts into web pages, potentially leading to session hijacking, defacement of web pages, and theft of sensitive information.
Upgrade to version 3.3.5 or later of the lxml library.
Implement additional input validation and sanitization measures in the affected code, or use a robust HTML sanitizer.
No, the provided information does not include a CVSS score for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
