CVE-2026-28348

Опубликовано: 05 мар. 2026

Источник: nvd

CVSS3: 6.1

EPSS Низкий

Описание

lxml_html_clean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.4, the _has_sneaky_javascript() method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression() filters, allowing external CSS loading or XSS in older browsers. This issue has been patched in version 0.4.4.

Ссылки

https://github.com/fedora-python/lxml_html_clean/commit/2ef732667ddbc74ea59847bcf24b75809aaeed3b
Patch
https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-hw26-mmpg-fqfg
Exploit
Vendor Advisory
https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-hw26-mmpg-fqfg
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:fedoralovespython:lxml_html_clean:*:*:*:*:*:python:*:*

Версия до 0.4.4 (исключая)

EPSS

Процентиль: 8%

0.0003

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-116

Связанные уязвимости

CVE-2026-28348

CVSS3: 6.1

ubuntu

25 дней назад

lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javascript() method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression() filters, allowing external CSS loading or XSS in older browsers. This issue has been patched in version 0.4.4.

CVE-2026-28348

CVSS3: 6.1

debian

25 дней назад

lxml_html_clean is a project for HTML cleaning functionalities copied ...

GHSA-hw26-mmpg-fqfg

CVSS3: 6.1

github

28 дней назад

lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes

openSUSE-SU-2026:20345-1

suse-cvrf

19 дней назад

Security update for python-lxml_html_clean

EPSS

Процентиль: 8%

0.0003

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-116