Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2014-3146

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-57qw-cc2g-pv5p

lxml Cross-site Scripting Via Control Characters Incomplete blacklist vulnerability in the `lxml.html.clean` module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the `clean_html` function.

gitlab/pypi/lxml/CVE-2014-3146

lxml Cross-site Scripting Via Control Characters HTML cleaning can fail to strip Javascript links that mix control characters into the link scheme.

gitlab/pypi/python-lxml/CVE-2014-3146

Code Injection Incomplete denylist in the `lxml.html.clean module` in lxml allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the `clean_html` function.