Improper Neutralization of Input During Web Page Generation in LXML

Also known as GHSA-xp26-p53h-6h2p, PYSEC-2018-12

Published 7 y ago 2018-12-02 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.1 · CNA

CISA KEV

not known exploited

EPSS

2.4%

percentile 84%

Public exploits

none known

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 10 mo ago 2025-12-18

Exploit prediction (EPSS)

2.44% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
CNA	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`
GitHub	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
pypi	`lxml`	<4.2.5	4.2.5

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

usn.ubuntu.com /3841-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
lists.debian.org /debian-lts-announce/2018/12/msg00001.html · mailing-list, x_refsource_MLIST, x_transferred
usn.ubuntu.com /3841-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
github.com /lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109 · x_refsource_MISC, x_transferred
lists.debian.org /debian-lts-announce/2020/11/msg00044.html · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-19787 · advisory
github.com /advisories/GHSA-xp26-p53h-6h2p · advisory
github.com /lxml/lxml · web
github.com /pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2018-12.yaml · web
usn.ubuntu.com /3841-1 · web
usn.ubuntu.com /3841-2 · web

Sources

CVE List: CVE-2018-19787
GitHub Advisory: GHSA-xp26-p53h-6h2p
NVD: CVE-2018-19787
OSV: PYSEC-2018-12

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary