GHSA-xvp8-3mhv-424c
Medium · 6.1CVSS
6.1
EPSS
—
Published
Mar 2, 2026
CISA due date
—
The record
lxml-html-clean has <base> tag injection through default Cleaner configuration
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | lxml-html-clean | 0 | 0.4.4 |
Related vulnerabilities
- CVE-2026-28350 lxml_html_clean is a project for HTML cleaning functionalities copied from… Same vulnerability
- CVE-2026-28348 lxml_html_clean is a project for HTML cleaning functionalities copied from… Also affects lxml-html-clean
- GHSA-hw26-mmpg-fqfg lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes Also affects lxml-html-clean
- CVE-2024-52595 HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through Also affects lxml-html-clean
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-104250 The unstructured library provides open-source components for ingesting and pre-processing… CWE-116