CVE-2024-52595: lxml-html-clean HTML Parser Context-Switching Vulnerability
Summary
CVE-2024-52595: lxml_html_clean is a project for HTML cleaning functionalities copied from lxml.html.clean. Affects lxml-html-clean across 2 version ranges.
< 0.4.0
< c5d816f86eb3707d72a8ecf5f3823e0daa1b3808
Fixed in c5d816f86eb3707d72a8ecf5f3823e0daa1b3808. How to fix ↓
Also tracked for
- lxml-html-clean · Debian:13
The same CVE-2024-52595 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml-html-clean is a Python package that provides HTML cleaning functionalities, derived from lxml.html.clean. It is designed to sanitize untrusted HTML content, making it safer for use in web applications. However, prior to version 0.4.0, the package's HTML parser exhibited flaws in handling context-switching for special HTML tags like <svg>, <math>, and <noscript>, which are critical for proper HTML rendering and security.
Vulnerability Detail
The vulnerability arises from the lxml HTML Parser's improper handling of context-switching for certain HTML tags. This issue leads to a deviation from standard web browser behavior, where content within CSS comments is ignored by lxml-html-clean but may be processed differently by browsers. This inconsistency can enable malicious scripts to bypass the cleaning process, potentially leading to Cross-Site Scripting (XSS) attacks. Users relying on lxml-html-clean for sanitizing HTML content in security-sensitive contexts are particularly at risk.
How To Fix
Latest published version: 0.4.5 as of 22 Oct 2026
pip install --upgrade "lxml-html-clean==0.4.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
c5d816f86eb3707d72a8ecf5f3823e0daa1b3808
This is the first release that contains the fix.
pip install --upgrade "lxml-html-clean==c5d816f86eb3707d72a8ecf5f3823e0daa1b3808"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary mitigation, users can configure lxml-html-clean with specific settings to prevent exploitation of this vulnerability. For example, you can specify tags to remove or restrict permissible tags using the following configurations:
from lxml_html_clean import Cleaner
cleaner = Cleaner(
remove_tags=['svg', 'math', 'noscript'],
kill_tags=['script'],
allow_tags=['p', 'div', 'span']
)
This code snippet demonstrates how to set up the cleaner to remove certain tags and restrict others, enhancing security until an upgrade can be performed.
Conclusion
The lxml-html-clean package has a significant vulnerability related to its HTML parsing capabilities, particularly concerning context-switching for special tags. Users are strongly advised to upgrade to the latest version to mitigate risks associated with XSS attacks. Temporary workarounds are available but should not replace a proper update.
See every vulnerability recorded for lxml-html-clean →
FAQ
The vulnerability involves improper handling of context-switching for special HTML tags, which can lead to XSS attacks.
You can check for vulnerabilities using Vulert, which monitors open-source vulnerabilities in your software without requiring code access.
Upgrade to lxml-html-clean version 0.4.0 or later to fix the vulnerability.
Yes, you can configure the cleaner to remove or restrict certain tags as a temporary workaround.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for lxml-html-clean.
