CVE-2014-3146: Cross-Site Scripting (XSS) in lxml
Summary
CVE-2014-3146: Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html func... Affects lxml versions < 3.3.5. Fixed in 3.3.5. How to fix ↓
Also tracked for
- lxml · Debian:11
The same CVE-2014-3146 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
lxml is a Python library that provides a powerful and easy-to-use interface for parsing and manipulating XML and HTML documents. It is widely used in various applications for processing and extracting data from XML and HTML files. However, versions of lxml before 3.3.5 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3146, is an incomplete blacklist vulnerability in the lxml.html.clean module. It allows remote attackers to conduct XSS attacks by exploiting control characters in the link scheme parameter passed to the clean_html function. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially compromising sensitive information or performing malicious actions.
How To Fix
Latest published version: 6.1.3 as of 22 Oct 2026
pip install --upgrade "lxml==6.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.5
This is the first release that contains the fix.
pip install --upgrade "lxml==3.3.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to sanitize and validate all user-supplied input, especially when it is used in HTML or JavaScript contexts, to mitigate the risk of XSS attacks.
Conclusion
In conclusion, the vulnerability CVE-2014-3146 in lxml exposes applications to cross-site scripting (XSS) attacks. To mitigate this risk, it is crucial to upgrade lxml to version 3.3.5 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lxml →
FAQ
lxml is a Python library for processing XML and HTML documents.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Applications using vulnerable versions of lxml are at risk of being exploited by attackers to execute arbitrary JavaScript code in the context of the victim's browser.
Yes, upgrading lxml to version 3.3.5 or later will fix this vulnerability.
There are no specific instances mentioned in the vulnerability details. However, it is always important to promptly apply security patches and updates to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
