CVE-2026-28348
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Mar 5, 2026
CISA due date
—
The record
lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javascript() method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression() filters, allowing external CSS loading or XSS in older browsers. This issue has been patched in version 0.4.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | lxml-html-clean | 0 | 0.4.4 |
| openSUSE:Leap 16.0 | python-lxml_html_clean | 0 | 0.4.2-bp160.2.1 |
| openSUSE:Tumbleweed | python-lxml_html_clean | 0 | 0.4.4-1.1 |
Related vulnerabilities
- GHSA-hw26-mmpg-fqfg lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes Same vulnerability
- CVE-2026-28350 lxml_html_clean is a project for HTML cleaning functionalities copied from… Also affects lxml-html-clean
- GHSA-xvp8-3mhv-424c lxml-html-clean has tag injection through default Cleaner configuration Also affects lxml-html-clean
- CVE-2024-52595 HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through Also affects lxml-html-clean
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-104250 The unstructured library provides open-source components for ingesting and pre-processing… CWE-116