HTML Cleaner allows crafted and SVG embedded scripts to pass through
Priority MEDIUM 41CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Partial Red Hat: 4 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02641 85th percentileScored 2026-11-07
Fix Partial lxml (lxml): 4.6.5lxml (PyPI): 4.6.5Red Hat: 6 advisoriesRed Hat: 4 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lxml | lxml | before 4.6.5 | 4.6.5 | Patch available | CNA |
| — | lxml (PyPI) | before 4.6.5 | 4.6.5 | Patch available | GHSA-55x5-fj6c-h6m8 |
- lxml Vendorlxml Affected before 4.6.5 Fixed in 4.6.5 Patch available CNA
- lxml (PyPI) Vendor— Affected before 4.6.5 Fixed in 4.6.5 Patch available GHSA-55x5-fj6c-h6m8
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:* | before 4.6.5 | Vulnerable | lxml |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire_enterprise_sds:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:hci_storage_node_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:* Versions before 4.6.5 Vulnerable ·lxml
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire_enterprise_sds:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:hci_storage_node_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* | 22.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:* | 22.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:* | 22.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* Versions 22.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:* Versions 22.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:* Versions 22.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
Remediation
- Fix · CNA lxml (lxml) Fixed in 4.6.5
- Fix · GHSA-55x5-fj6c-h6m8 lxml (PyPI) Fixed in 4.6.5 Advisory →
Red Hat 6 advisories
- RHSA-2022:5498 Released 2022-07-05 · Red Hat rating ModerateSatellite 6.11 Release
- Red Hat Satellite 6.11 for RHEL 7 candlepin-4.1.13-1.el7sat, foreman-3.1.1.21-2.el7sat, libsolv-0.7.22-1.el7pc +4
- Red Hat Satellite 6.11 for RHEL 8 candlepin-4.1.13-1.el8sat, foreman-3.1.1.21-2.el8sat, libsolv-0.7.22-1.el8pc +8
- RHSA-2022:1932 Released 2022-05-10 · Red Hat rating Moderatepython-lxml security update
- Red Hat Enterprise Linux AppStream (v. 8) python-lxml-4.2.3-4.el8, python3-lxml-4.2.3-4.el8
- RHSA-2022:1763 Released 2022-05-10 · Red Hat rating Moderatepython39:3.9 and python39-devel:3.9 security update
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
Show 3 more Red Hat advisories
- RHSA-2022:1821 Released 2022-05-10 · Red Hat rating Moderatepython27:2.7 security update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, PyYAML-3.12-16.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, babel-2.5.1-10.module+el8.5.0+11014+88fc0d0b.noarch::python27:2.7 +47
- RHSA-2022:1764 Released 2022-05-10 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
- Red Hat Enterprise Linux CRB (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
- RHSA-2022:1664 Released 2022-05-02 · Red Hat rating ModerateRed Hat Software Collections security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python-lxml-4.4.1-8.el7
- Red Hat Software Collections for RHEL(v. 7) rh-python38-python-lxml-4.4.1-8.el7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ansible Tower 3 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:1763, RHSA-2022:1764, RHSA-2022:1821, RHSA-2022:1932 |
| Red Hat Satellite 6.11 for RHEL 8 | Fixed | RHSA-2022:5498 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:1664 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:1664 |
Not affected: 7 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux CRB (v. 8)
- Red Hat Satellite 6.11 for RHEL 7
- Red Hat Satellite 6.11 for RHEL 8
- Red Hat Software Collections for RHEL Workstation(v. 7)
- Red Hat Software Collections for RHEL(v. 7)
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43818
- 2026-10-03 Alias added: GHSA-55x5-fj6c-h6m8
References
Patch 5
- https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
- https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776
- https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Advisory 10
- https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
- FEDORA-2021-6e8fb79f90
- FEDORA-2021-9f9e7c5c4f
- [debian-lts-announce] 20211230 [SECURITY] [DLA 2871-1] lxml security update
- DSA-5043
- FEDORA-2022-96c79bf003
- FEDORA-2022-7129fbaeed
- https://security.netapp.com/advisory/ntap-20220107-0005/
- GLSA-202208-06
- https://nvd.nist.gov/vuln/detail/CVE-2021-43818
Other 7
- https://security.netapp.com/advisory/ntap-20220107-0005
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7
- https://lists.fedoraproject.org/archives/list/[email protected]/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7
- https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-852.yaml
- https://github.com/lxml/lxml
More Lxml vulnerabilities
- TI-2026-29705 lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files CVSS 3.1HIGH 7.5
- TI-2022-02132 NULL Pointer Dereference in lxml/lxml CVSS 3.1HIGH 7.5
- TI-2014-02511 Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5… CVSS 3.1MEDIUM 6.1
- TI-2021-09882 An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. CVSS 3.1MEDIUM 6.1
- TI-2020-16868 Cross-site scripting in python-lxml CVSS 3.1MEDIUM 6.1
- TI-2018-14010 An issue was discovered in lxml before 4.2.5. CVSS 3.1MEDIUM 6.1
Sources
- CVE-2021-43818 · CVE Program
- CVE-2021-43818 · NVD
- FIRST EPSS
- GHSA-55x5-fj6c-h6m8 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-43818 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences