CVE catalog

CVE-2018-19787

lxml: CVE-2018-19787

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.44% · Oct 25, 2026

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlxmlsid6.1.3-1.1fixed
Debianlxmlforky6.1.3-1fixed
Debianlxmltrixie5.4.0-1fixed
Debianlxmlbookworm4.9.2-1fixed
Debianlxmlbookworm-security4.9.2-1+deb12u1fixed
Ubuntulxml14.043.2.0-1vulnerable
Ubuntulxml14.043.3.0~beta2-1vulnerable
Ubuntulxml14.043.3.0~beta4-1vulnerable
Ubuntulxml14.043.3.1-1vulnerable
Ubuntulxml14.043.3.2-1vulnerable
Ubuntulxml14.043.3.2-1build1vulnerable
Ubuntulxml14.043.3.3-1vulnerable
Ubuntulxml14.043.3.3-1ubuntu0.1vulnerable
Ubuntulxml14.043.3.3-1ubuntu0.2fixed
Ubuntulxml16.043.4.4-1vulnerable
Ubuntulxml16.043.5.0-1vulnerable
Ubuntulxml16.043.5.0-1build1vulnerable
Ubuntulxml16.043.5.0-1ubuntu0.1fixed
Ubuntulxml18.044.0.0-1vulnerable
Ubuntulxml18.044.1.0-1vulnerable
Ubuntulxml18.044.2.0-1vulnerable
Ubuntulxml18.044.2.1-1vulnerable
Ubuntulxml18.044.2.1-1ubuntu0.1fixed
Susepython-lxmlhpe helion openstack 83.6.1-8.5.1fixed
Susepython-lxmlopenstack cloud 83.6.1-8.5.1fixed
Susepython-lxmlopenstack cloud crowbar 83.6.1-8.5.1fixed
Susepython-lxmllinux enterprise server 12 sp53.6.1-8.5.1fixed
Susepython-lxmllinux enterprise server for sap applications 12 sp53.6.1-8.5.1fixed
Suseardana-barbicanopenstack cloud 99.0+git.1644879908.8a641c1-3.13.1fixed
Susegrafanaopenstack cloud 96.7.4-3.26.1fixed
Suseopenstack-barbicanopenstack cloud 97.0.1~dev24-3.14.1fixed
Suseopenstack-cinderopenstack cloud 913.0.10~dev24-3.34.2fixed
Suseopenstack-heat-gbpopenstack cloud 914.0.1~dev4-3.9.1fixed
Suseopenstack-horizon-plugin-gbp-uiopenstack cloud 914.0.1~dev3-3.9.1fixed
Suseopenstack-ironicopenstack cloud 911.1.5~dev18-3.28.2fixed
Suseopenstack-keystoneopenstack cloud 914.2.1~dev9-3.28.2fixed
Suseopenstack-neutronopenstack cloud 913.0.8~dev206-3.40.1fixed
Suseopenstack-neutron-gbpopenstack cloud 914.0.1~dev33-3.31.1fixed
Susepython-Pillowopenstack cloud 95.2.0-3.17.1fixed
Susepython-XStatic-jquery-uiopenstack cloud 91.13.0.1-4.3.1fixed
Susepython-lxmlopenstack cloud 94.2.4-3.3.1fixed
Suserelease-notes-suse-openstack-cloudopenstack cloud 99.20220413-3.30.1fixed
Susevenv-openstack-barbicanopenstack cloud 97.0.1~dev24-3.35.2fixed
Susevenv-openstack-cinderopenstack cloud 913.0.10~dev24-3.38.1fixed
Susevenv-openstack-designateopenstack cloud 97.0.2~dev2-3.35.1fixed
Susevenv-openstack-glanceopenstack cloud 917.0.1~dev30-3.33.1fixed
Susevenv-openstack-heatopenstack cloud 911.0.4~dev4-3.35.1fixed
Susevenv-openstack-horizonopenstack cloud 914.1.1~dev11-4.39.1fixed
Susevenv-openstack-ironicopenstack cloud 911.1.5~dev18-4.33.1fixed
Susevenv-openstack-keystoneopenstack cloud 914.2.1~dev9-3.36.1fixed
Susevenv-openstack-magnumopenstack cloud 97.2.1~dev1-4.35.1fixed
Susevenv-openstack-manilaopenstack cloud 97.4.2~dev60-3.41.1fixed
Susevenv-openstack-monascaopenstack cloud 92.7.1~dev10-3.37.1fixed
Susevenv-openstack-monasca-ceilometeropenstack cloud 91.8.2~dev3-3.35.1fixed
Susevenv-openstack-neutronopenstack cloud 913.0.8~dev206-6.39.1fixed
Susevenv-openstack-novaopenstack cloud 918.3.1~dev91-3.39.1fixed
Susevenv-openstack-octaviaopenstack cloud 93.2.3~dev7-4.35.1fixed
Susevenv-openstack-saharaopenstack cloud 99.0.2~dev15-3.35.1fixed
Susevenv-openstack-swiftopenstack cloud 92.19.2~dev48-2.30.1fixed
Susegrafanaopenstack cloud crowbar 96.7.4-3.26.1fixed
Suseopenstack-barbicanopenstack cloud crowbar 97.0.1~dev24-3.14.1fixed
Suseopenstack-cinderopenstack cloud crowbar 913.0.10~dev24-3.34.2fixed
Suseopenstack-heat-gbpopenstack cloud crowbar 914.0.1~dev4-3.9.1fixed
Suseopenstack-horizon-plugin-gbp-uiopenstack cloud crowbar 914.0.1~dev3-3.9.1fixed
Suseopenstack-ironicopenstack cloud crowbar 911.1.5~dev18-3.28.2fixed
Suseopenstack-keystoneopenstack cloud crowbar 914.2.1~dev9-3.28.2fixed
Suseopenstack-neutronopenstack cloud crowbar 913.0.8~dev206-3.40.1fixed
Suseopenstack-neutron-gbpopenstack cloud crowbar 914.0.1~dev33-3.31.1fixed
Susepython-Pillowopenstack cloud crowbar 95.2.0-3.17.1fixed
Susepython-XStatic-jquery-uiopenstack cloud crowbar 91.13.0.1-4.3.1fixed
Susepython-lxmlopenstack cloud crowbar 94.2.4-3.3.1fixed
Suserelease-notes-suse-openstack-cloudopenstack cloud crowbar 99.20220413-3.30.1fixed
Suserubygem-sinatraopenstack cloud crowbar 91.4.6-4.3.1fixed
Ubuntulxml14.043.2.0-1vulnerable
Ubuntulxml14.043.3.0~beta2-1vulnerable
Ubuntulxml14.043.3.0~beta4-1vulnerable
Ubuntulxml14.043.3.1-1vulnerable
Ubuntulxml14.043.3.2-1vulnerable
Ubuntulxml14.043.3.2-1build1vulnerable
Ubuntulxml14.043.3.3-1vulnerable
Ubuntulxml14.043.3.3-1ubuntu0.1vulnerable
Ubuntulxml14.043.3.3-1ubuntu0.2fixed
Ubuntulxml16.043.4.4-1vulnerable
Ubuntulxml16.043.5.0-1vulnerable
Ubuntulxml16.043.5.0-1build1vulnerable
Ubuntulxml16.043.5.0-1ubuntu0.1fixed
Ubuntulxml18.044.0.0-1vulnerable
Ubuntulxml18.044.1.0-1vulnerable
Ubuntulxml18.044.2.0-1vulnerable
Ubuntulxml18.044.2.1-1vulnerable
Ubuntulxml18.044.2.1-1ubuntu0.1fixed
Opensusepython-lxmlleap 15.34.7.1-3.7.1fixed
Susepython-lxmllinux enterprise module for basesystem 15 sp34.7.1-3.7.1fixed
Susepython-lxmllinux enterprise module for python 2 15 sp34.7.1-3.7.1fixed
Susepython-lxmllinux enterprise high performance computing 15 sp2-espos4.7.1-3.7.1fixed
Susepython-lxmllinux enterprise high performance computing 15 sp2-ltss4.7.1-3.7.1fixed
Susepython-lxmllinux enterprise real time 15 sp24.7.1-3.7.1fixed
Susepython-lxmllinux enterprise server 15 sp2-bcl4.7.1-3.7.1fixed
Susepython-lxmllinux enterprise server 15 sp2-ltss4.7.1-3.7.1fixed
Susepython-lxmllinux enterprise server for sap applications 15 sp24.7.1-3.7.1fixed
Susepython-lxmlmanager proxy 4.14.7.1-3.7.1fixed
Susepython-lxmlmanager retail branch server 4.14.7.1-3.7.1fixed
Susepython-lxmlmanager server 4.14.7.1-3.7.1fixed
Susepython-lxmlenterprise storage 74.7.1-3.7.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlxmlsourcesid4.2.5-1not yet assignedNot reportedNot reported
Debianlxmlsourceforky4.2.5-1not yet assignedNot reportedNot reported
Debianlxmlsourcetrixie4.2.5-1not yet assignedNot reportedNot reported
Debianlxmlsourcebookworm4.2.5-1not yet assignedNot reportedNot reported
Ubuntulxmldeb14.043.3.3-1ubuntu0.2Not reportedUSN-3841-1Not reported
Ubuntulxmldeb16.043.5.0-1ubuntu0.1Not reportedUSN-3841-1Not reported
Ubuntulxmldeb18.044.2.1-1ubuntu0.1Not reportedUSN-3841-1Not reported
Susepython-lxmlrpmhpe helion openstack 83.6.1-8.5.1Not reportedSUSE-SU-2022:0895-1Not reported
Susepython-lxmlrpmopenstack cloud 83.6.1-8.5.1Not reportedSUSE-SU-2022:0895-1Not reported
Susepython-lxmlrpmopenstack cloud crowbar 83.6.1-8.5.1Not reportedSUSE-SU-2022:0895-1Not reported
Susepython-lxmlrpmlinux enterprise server 12 sp53.6.1-8.5.1Not reportedSUSE-SU-2022:0895-1Not reported
Susepython-lxmlrpmlinux enterprise server for sap applications 12 sp53.6.1-8.5.1Not reportedSUSE-SU-2022:0895-1Not reported
Suseardana-barbicanrpmopenstack cloud 99.0+git.1644879908.8a641c1-3.13.1Not reportedSUSE-SU-2022:1729-1Not reported
Susegrafanarpmopenstack cloud 96.7.4-3.26.1Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-barbicanrpmopenstack cloud 97.0.1~dev24-3.14.1Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-cinderrpmopenstack cloud 913.0.10~dev24-3.34.2Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-heat-gbprpmopenstack cloud 914.0.1~dev4-3.9.1Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-horizon-plugin-gbp-uirpmopenstack cloud 914.0.1~dev3-3.9.1Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-ironicrpmopenstack cloud 911.1.5~dev18-3.28.2Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-keystonerpmopenstack cloud 914.2.1~dev9-3.28.2Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-neutronrpmopenstack cloud 913.0.8~dev206-3.40.1Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-neutron-gbprpmopenstack cloud 914.0.1~dev33-3.31.1Not reportedSUSE-SU-2022:1729-1Not reported
Susepython-Pillowrpmopenstack cloud 95.2.0-3.17.1Not reportedSUSE-SU-2022:1729-1Not reported
Susepython-XStatic-jquery-uirpmopenstack cloud 91.13.0.1-4.3.1Not reportedSUSE-SU-2022:1729-1Not reported
Susepython-lxmlrpmopenstack cloud 94.2.4-3.3.1Not reportedSUSE-SU-2022:1729-1Not reported
Suserelease-notes-suse-openstack-cloudrpmopenstack cloud 99.20220413-3.30.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-barbicanrpmopenstack cloud 97.0.1~dev24-3.35.2Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-cinderrpmopenstack cloud 913.0.10~dev24-3.38.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-designaterpmopenstack cloud 97.0.2~dev2-3.35.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-glancerpmopenstack cloud 917.0.1~dev30-3.33.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-heatrpmopenstack cloud 911.0.4~dev4-3.35.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-horizonrpmopenstack cloud 914.1.1~dev11-4.39.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-ironicrpmopenstack cloud 911.1.5~dev18-4.33.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-keystonerpmopenstack cloud 914.2.1~dev9-3.36.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-magnumrpmopenstack cloud 97.2.1~dev1-4.35.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-manilarpmopenstack cloud 97.4.2~dev60-3.41.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-monascarpmopenstack cloud 92.7.1~dev10-3.37.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-monasca-ceilometerrpmopenstack cloud 91.8.2~dev3-3.35.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-neutronrpmopenstack cloud 913.0.8~dev206-6.39.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-novarpmopenstack cloud 918.3.1~dev91-3.39.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-octaviarpmopenstack cloud 93.2.3~dev7-4.35.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-sahararpmopenstack cloud 99.0.2~dev15-3.35.1Not reportedSUSE-SU-2022:1729-1Not reported
Susevenv-openstack-swiftrpmopenstack cloud 92.19.2~dev48-2.30.1Not reportedSUSE-SU-2022:1729-1Not reported
Susegrafanarpmopenstack cloud crowbar 96.7.4-3.26.1Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-barbicanrpmopenstack cloud crowbar 97.0.1~dev24-3.14.1Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-cinderrpmopenstack cloud crowbar 913.0.10~dev24-3.34.2Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-heat-gbprpmopenstack cloud crowbar 914.0.1~dev4-3.9.1Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-horizon-plugin-gbp-uirpmopenstack cloud crowbar 914.0.1~dev3-3.9.1Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-ironicrpmopenstack cloud crowbar 911.1.5~dev18-3.28.2Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-keystonerpmopenstack cloud crowbar 914.2.1~dev9-3.28.2Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-neutronrpmopenstack cloud crowbar 913.0.8~dev206-3.40.1Not reportedSUSE-SU-2022:1729-1Not reported
Suseopenstack-neutron-gbprpmopenstack cloud crowbar 914.0.1~dev33-3.31.1Not reportedSUSE-SU-2022:1729-1Not reported
Susepython-Pillowrpmopenstack cloud crowbar 95.2.0-3.17.1Not reportedSUSE-SU-2022:1729-1Not reported
Susepython-XStatic-jquery-uirpmopenstack cloud crowbar 91.13.0.1-4.3.1Not reportedSUSE-SU-2022:1729-1Not reported
Susepython-lxmlrpmopenstack cloud crowbar 94.2.4-3.3.1Not reportedSUSE-SU-2022:1729-1Not reported
Suserelease-notes-suse-openstack-cloudrpmopenstack cloud crowbar 99.20220413-3.30.1Not reportedSUSE-SU-2022:1729-1Not reported
Suserubygem-sinatrarpmopenstack cloud crowbar 91.4.6-4.3.1Not reportedSUSE-SU-2022:1729-1Not reported
Ubuntulxmldeb14.043.3.3-1ubuntu0.2Not reportedUBUNTU-CVE-2018-19787Not reported
Ubuntulxmldeb16.043.5.0-1ubuntu0.1Not reportedUBUNTU-CVE-2018-19787Not reported
Ubuntulxmldeb18.044.2.1-1ubuntu0.1Not reportedUBUNTU-CVE-2018-19787Not reported
Opensusepython-lxmlrpmleap 15.34.7.1-3.7.1Not reportedOPENSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmlinux enterprise module for basesystem 15 sp34.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmlinux enterprise module for python 2 15 sp34.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmlinux enterprise high performance computing 15 sp2-espos4.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmlinux enterprise high performance computing 15 sp2-ltss4.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmlinux enterprise real time 15 sp24.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmlinux enterprise server 15 sp2-bcl4.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmlinux enterprise server 15 sp2-ltss4.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmlinux enterprise server for sap applications 15 sp24.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmmanager proxy 4.14.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmmanager retail branch server 4.14.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmmanager server 4.14.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported
Susepython-lxmlrpmenterprise storage 74.7.1-3.7.1Not reportedSUSE-SU-2022:0803-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-lxml]Fixed

    Source package: [lxml]

    Details (2)

    • 4.9.2-1+b1 · amd64 · bookworm

      Fixed · Fixed: 4.2.5-1

      dsa · lxml · debian · bookworm; dsa · lxml · debian · 12

    • 4.9.2-1+b1 · arm64 · bookworm

      Fixed · Fixed: 4.2.5-1

      dsa · lxml · debian · bookworm; dsa · lxml · debian · 12

  • [python-lxml-doc]Fixed

    Source package: [lxml]

    Details (2)

    • 4.9.2-1 · all · bookworm

      Fixed · Fixed: 4.2.5-1

      dsa · lxml · debian · bookworm; dsa · lxml · debian · 12

    • 4.9.2-1 · all · bookworm

      Fixed · Fixed: 4.2.5-1

      dsa · lxml · debian · bookworm; dsa · lxml · debian · 12

[Debian 13 (Trixie)]

  • [python3-lxml]Fixed

    Source package: [lxml]

    Details (2)

    • 5.4.0-1 · amd64 · trixie

      Fixed · Fixed: 4.2.5-1

      dsa · lxml · debian · 13

    • 5.4.0-1 · arm64 · trixie

      Fixed · Fixed: 4.2.5-1

      dsa · lxml · debian · 13

  • [python-lxml-doc]Fixed

    Source package: [lxml]

    Details (2)

    • 5.4.0-1 · all · trixie

      Fixed · Fixed: 4.2.5-1

      dsa · lxml · debian · 13

    • 5.4.0-1 · all · trixie

      Fixed · Fixed: 4.2.5-1

      dsa · lxml · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]