Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

lxml

7 known vulnerabilities (2 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 high, 5 medium
Weekly downloads
106.7M
Dependents
28.7K
Registry
PyPI

Advisories 7

  • lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

    Affected: fixed in 6.1.0.

  • CVE-2022-2309Medium 5.3

    NULL Pointer Dereference in lxml/lxml

    Affected: fixed in 4.9.1; fixed in 4.9.1.

  • HTML Cleaner allows crafted and SVG embedded scripts to pass through

    Affected: fixed in 4.6.5; fixed in 4.6.5.

  • CVE-2021-28957Medium 6.1

    An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3.

    Affected: fixed in 4.6.3; fixed in 4.6.3.

  • CVE-2020-27783Medium 6.1

    A XSS vulnerability was discovered in python-lxml's clean module.

    Affected: from 1.2, fixed in 4.6.2; fixed in 4.6.2.

  • CVE-2018-19787Medium 6.1

    An issue was discovered in lxml before 4.2.5.

    Affected: fixed in 4.2.5; fixed in 4.2.5.

  • CVE-2014-3146Medium 6.1

    Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site…

    Affected: fixed in 3.3.5; fixed in 3.3.5.