PyPIPackage

lxml-html-clean

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-49825High 8.2
lxml: javascript: URL bypass in Cleaner via xlink:href
Affected: fixed in 0.4.5.
Fixed in 0.4.5 (released May 20, 2026, 92 days before disclosure).
The latest release, 0.4.6, is not affected.
CVE-2026-28350Medium 6.1
lxml_html_clean: <base> tag injection through default Cleaner configuration
Affected: fixed in 0.4.4.
Fixed in 0.4.4 (released Feb 27, 2026, 6 days before disclosure).
The latest release, 0.4.6, is not affected.
CVE-2026-28348Medium 6.1
lxml_html_clean: CSS @import Filter Bypass via Unicode Escapes
Affected: fixed in 0.4.4.
Fixed in 0.4.4 (released Feb 27, 2026, 6 days before disclosure).
The latest release, 0.4.6, is not affected.
CVE-2024-52595High 7.7
HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through
Affected: fixed in 0.4.0.
Fixed in 0.4.0 (released Nov 14, 2024, 5 days before disclosure).
The latest release, 0.4.6, is not affected.