CVE-2021-28957: XSS
A flaw was found in python-lxml. The HTML5 formaction attribute is not input sanitized like the HTML action attribute is which can lead to a Cross-Site Scripting attack (XSS) when an application uses python-lxml to sanitize user inputs. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
An XSS vulnerability was discovered in the python lxml clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
— GitHub
lxml 4.6.2 allows XSS. It places the HTML action attribute into defs.linkattrs (in html/defs.py) for later use in input sanitization, but does not do the same for the HTML5 formaction attribute.
Reference:
https://bugs.launchpad.net/lxml/+bug/1888153
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-28957?
CVE-2021-28957 is an XSS vulnerability in the python `lxml` clean module versions before 4.6.3.
How does CVE-2021-28957 work?
CVE-2021-28957 allows a remote attacker to bypass the sanitizer by exploiting the `formaction` attribute in the HTML5 form.
Which software versions are affected by CVE-2021-28957?
The python `lxml` clean module versions before 4.6.3 are affected by CVE-2021-28957.
What is the severity of CVE-2021-28957?
CVE-2021-28957 has a severity rating of 6.1 (high).
How can CVE-2021-28957 be fixed?
To fix CVE-2021-28957, upgrade to python `lxml` clean module version 4.6.3 or later.