HIGH8.2PyPI
GHSA-4jhm-jv67-739f· CVE-2026-49825, PYSEC-2026-2614`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes
Modified: 7/13/2026
package
PyPI/lxml-html-clean
pkg:pypi/lxml-html-clean
HIGH7.7PyPI
GHSA-5jfw-gq64-q45f· CVE-2024-52595, PYSEC-2024-160HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through
Modified: 1/14/2025
MEDIUM6.1PyPI
GHSA-hw26-mmpg-fqfg· CVE-2026-28348, PYSEC-2026-2201lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes
Modified: 9/10/2026
MEDIUM6.1PyPI
GHSA-xvp8-3mhv-424c· CVE-2026-28350, PYSEC-2026-2202lxml-html-clean has <base> tag injection through default Cleaner configuration
Modified: 9/10/2026
MEDIUM6.1PyPI
PYSEC-2024-160· CVE-2024-52595, GHSA-5jfw-gq64-q45fModified: 1/14/2025
MEDIUM6.1PyPI
PYSEC-2026-2201· CVE-2026-28348, GHSA-hw26-mmpg-fqfgModified: 7/13/2026
MEDIUM6.1PyPI
PYSEC-2026-2202· CVE-2026-28350, GHSA-xvp8-3mhv-424cModified: 7/13/2026
HIGH8.2PyPI
PYSEC-2026-2614· CVE-2026-49825, GHSA-4jhm-jv67-739f`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes
Modified: 7/13/2026