CVE-2018-19787: XSS
An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.
Other sources
lxml is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the lxml/html/clean.py script. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-19787.
What is the severity of CVE-2018-19787?
The severity of CVE-2018-19787 is medium with a severity value of 6.1.
What is the affected software?
The affected software is lxml before version 4.2.5.
How can I fix the vulnerability in lxml?
To fix the vulnerability in lxml, update to version 4.2.5 or a higher version.
Where can I find more information about CVE-2018-19787?
You can find more information about CVE-2018-19787 on the MITRE CVE database: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19787