AZL-6808

Dashboard / Vulnerabilities / AZL-6808

AZL-6808

Summary: CVE-2021-28957 affecting package python-lxml for versions less than 4.8.0-1

Details: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

References: https://nvd.nist.gov/vuln/detail/CVE-2021-28957