CVE-2026-28350
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Mar 5, 2026
CISA due date
—
The record
lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for <base>, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | lxml-html-clean | 0 | 0.4.4 |
| openSUSE:Leap 16.0 | python-lxml_html_clean | 0 | 0.4.2-bp160.2.1 |
| openSUSE:Tumbleweed | python-lxml_html_clean | 0 | 0.4.4-1.1 |
Related vulnerabilities
- GHSA-xvp8-3mhv-424c lxml-html-clean has tag injection through default Cleaner configuration Same vulnerability
- CVE-2026-28348 lxml_html_clean is a project for HTML cleaning functionalities copied from… Also affects lxml-html-clean
- GHSA-hw26-mmpg-fqfg lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes Also affects lxml-html-clean
- CVE-2024-52595 HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through Also affects lxml-html-clean
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-104250 The unstructured library provides open-source components for ingesting and pre-processing… CWE-116