CVE-2024-52595

What it actually does

The lxml HTML parser fails to correctly manage context switches for special tags such as <svg>, <math>, and <noscript>, allowing CSS comment content ignored during cleaning to be interpreted as executable script by browsers, resulting in sanitization bypass and XSS.

Why it matters to the business

Applications relying on default lxml_html_clean sanitization for untrusted HTML face elevated risk of script injection attacks that can compromise user sessions and data integrity; older Ubuntu ImageMagick and lxml_html_clean packages remain exposed until upgraded.

How an attack unfolds

An attacker crafts malicious HTML containing special tags with script payloads hidden inside CSS comments, submits it to a service using vulnerable lxml_html_clean for sanitization, and the cleaned output is rendered by a browser that interprets the hidden content as executable code.

How to fix it

Upgrade lxml_html_clean to commit a0744252196ea31dfa0edeb92e3bd45d048a7beb or later; for affected Ubuntu packages upgrade ImageMagick to 8:6.7.7.10-6ubuntu3.2 on 14.04 LTS or 8:6.8.9.9-7ubuntu5.2 on 16.04 LTS; test sanitization behavior against browser rendering after upgrade.

How to confirm the fix worked

Confirm the installed lxml_html_clean or ImageMagick version matches or exceeds the listed fixed versions, then re-run HTML sanitization tests with context-switching tags and CSS comments to verify scripts are now stripped consistently with browser behavior.

Typical attack path

1. Identify a target application that sanitizes user-supplied HTML with lxml_html_clean in its default configuration
2. Construct HTML payload embedding script inside CSS comments wrapped in context-switching tags such as <svg> or <noscript>
3. Submit the payload through an input vector that reaches the sanitizer
4. Observe that the output passes sanitization yet executes when rendered in a browser
5. Leverage the resulting XSS for session hijacking or other client-side actions

How to detect it

Search web application or proxy logs for requests containing <svg>, <math>, or <noscript> tags paired with CSS comment patterns that survive sanitization; inspect rendered page sources or CSP violation reports for unexpected script execution originating from sanitized content.

What your security team should do

• Prioritize upgrade of lxml_html_clean and affected ImageMagick packages to the exact fixed versions provided
• Add automated regression tests that compare sanitizer output against browser rendering for special tags
• Review any downstream dependents that embed the vulnerable cleaner and schedule coordinated updates
• Monitor for new EPSS or exploit maturity signals given the low but stable score