CVE-2014-3146

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.

Affected products

Suse, Ubuntu, Lxml

Lxml

≤ 3.3.4, 0.5, 0.5.1, 0.6, 0.7, 0.8, 0.9, 0.9.1, 0.9.2, 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1, 1.1.1, 1.1.2, 1.2, 1.2.1, 1.3, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.1, 2.1.1

Fix

Available

CVSS 3.1

6.1 MEDIUM

EPSS

6.3% (93th percentile)

Weakness

CWE-79

NVD status

Modified

Published

2014-05-14