CVE-2021-28957

Description

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

How to fix CVE-2021-28957

To remediate CVE-2021-28957, upgrade the affected package to a fixed version below.

• —upgrade to 4.6.3-r0 or later
• —upgrade to 4.6.3-1 or later
• —upgrade to 3.7.1-1+deb9u4 or later
• —upgrade to 4.3.2-1+deb10u3 or later
• —upgrade to 4.6.3 or later
• —upgrade to a5f9cb52079dc57477c460dbe6ba0f775e14a999 or later

Is CVE-2021-28957 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• from 0, < 4.6.3-r0
• from 0, < 4.6.3-1
• from 0, < 3.7.1-1+deb9u4
• from 0, < 4.3.2-1+deb10u3
• from 0, < 4.6.3
• from 0, < a5f9cb52079dc57477c460dbe6ba0f775e14a999 | from 0, < 4.6.3

CVSS scores

References (19)

• ADVISORYgithub.com/advisories/GHSA-jq4v-f5q6-mjqq
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-28957
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-28957
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-28957
• PATCH