CVE-2014-3146

What it actually does

The lxml.html.clean module's clean_html function fails to sanitize control characters embedded in link schemes due to an incomplete blacklist, allowing crafted HTML to bypass sanitization and execute arbitrary JavaScript in the context of the rendered page.

Why it matters to the business

Attackers can inject scripts that steal user data, hijack sessions, or deface content when users view sanitized but still vulnerable HTML output from affected applications.

How an attack unfolds

An attacker supplies HTML containing a link element whose href scheme includes control characters to the clean_html function; the incomplete blacklist permits the payload to survive sanitization and render as executable script in victim browsers.

How to fix it

Upgrade lxml to version 3.3.5 or later; after upgrade, re-test all code paths that invoke clean_html on external or user-supplied content.

How to confirm the fix worked

Confirm installed lxml version is at least 3.3.5; run unit tests that feed control-character link schemes to clean_html and verify the output no longer contains executable script tags.

Typical attack path

1. Identify an application endpoint that passes untrusted HTML through lxml.html.clean.clean_html
2. Craft a link element with a scheme containing ASCII control characters that evades the blacklist
3. Submit the payload via user-controlled input or stored content
4. Victim browser renders the unsanitized output and executes the injected script

How to detect it

Review application logs for calls to clean_html receiving link schemes that contain non-printable characters; examine web server access logs for requests carrying unusual href values with control characters.

What your security team should do

• Immediately update lxml to 3.3.5+ in all environments
• Audit code for direct or indirect calls to clean_html on untrusted data
• Add automated dependency scanning to prevent future outdated lxml deployments