HIGH8.2PyPI
GHSA-55x5-fj6c-h6m8· CVE-2021-43818, PYSEC-2021-852lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through
Modified: 7/8/2026
package
PyPI/lxml
pkg:pypi/lxml
MEDIUM6.1PyPI
GHSA-57qw-cc2g-pv5p· CVE-2014-3146, PYSEC-2014-9lxml Cross-site Scripting Via Control Characters
Modified: 9/30/2024
MEDIUM6.1PyPI
GHSA-jq4v-f5q6-mjqq· CVE-2021-28957, PYSEC-2021-19lxml vulnerable to Cross-Site Scripting
Modified: 9/30/2024
MEDIUM6.1PyPI
GHSA-pgww-xf46-h92r· CVE-2020-27783, PYSEC-2020-62lxml vulnerable to Cross-site Scripting
Modified: 12/20/2025
HIGH7.5PyPI
GHSA-vfmq-68hx-4jfw· CVE-2026-41066, PYSEC-2026-87lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-wrxv-2j5q-m38w· CVE-2022-2309, PYSEC-2022-230lxml NULL Pointer Dereference allows attackers to cause a denial of service
Modified: 11/4/2025
MEDIUM6.1PyPI
GHSA-xp26-p53h-6h2p· CVE-2018-19787, PYSEC-2018-12Improper Neutralization of Input During Web Page Generation in LXML
Modified: 12/20/2025
—PyPI
PYSEC-2014-9· CVE-2014-3146, GHSA-57qw-cc2g-pv5pModified: 6/10/2026
—PyPI
PYSEC-2018-12· CVE-2018-19787, GHSA-xp26-p53h-6h2pModified: 11/8/2023
—PyPI
PYSEC-2020-62· CVE-2020-27783, GHSA-pgww-xf46-h92rModified: 11/8/2023
—PyPI
PYSEC-2021-19· CVE-2021-28957, GHSA-jq4v-f5q6-mjqqModified: 11/8/2023
—PyPI
PYSEC-2021-852· CVE-2021-43818, GHSA-55x5-fj6c-h6m8Modified: 4/9/2026
—PyPI
PYSEC-2022-230· CVE-2022-2309, GHSA-wrxv-2j5q-m38wModified: 11/8/2023
HIGH7.5PyPI
PYSEC-2026-87· CVE-2026-41066, GHSA-vfmq-68hx-4jfwModified: 5/20/2026