CVE catalog

CVE-2021-28957

lxml: CVE-2021-28957

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
4.04% · Oct 27, 2026

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlxmlsid6.1.3-1.1fixed
Debianlxmlforky6.1.3-1fixed
Debianlxmltrixie5.4.0-1fixed
Debianlxmlbookworm4.9.2-1fixed
Debianlxmlbookworm-security4.9.2-1+deb12u1fixed
Alpinepy3-lxml3.164.6.3-r0fixed
Alpinepy3-lxml3.174.6.3-r0fixed
Alpinepy3-lxml3.184.6.3-r0fixed
Alpinepy3-lxml3.194.6.3-r0fixed
Alpinepy3-lxml3.204.6.3-r0fixed
Alpinepy3-lxml3.214.6.3-r0fixed
Alpinepy3-lxml3.224.6.3-r0fixed
Alpinepy3-lxml3.234.6.3-r0fixed
Alpinepy3-lxml3.244.6.3-r0fixed
Ubuntulxml16.043.4.4-1vulnerable
Ubuntulxml16.043.5.0-1vulnerable
Ubuntulxml16.043.5.0-1build1vulnerable
Ubuntulxml16.043.5.0-1ubuntu0.1vulnerable
Ubuntulxml16.043.5.0-1ubuntu0.2vulnerable
Ubuntulxml16.043.5.0-1ubuntu0.3vulnerable
Ubuntulxml16.043.5.0-1ubuntu0.4fixed
Ubuntulxml18.044.0.0-1vulnerable
Ubuntulxml18.044.1.0-1vulnerable
Ubuntulxml18.044.2.0-1vulnerable
Ubuntulxml18.044.2.1-1vulnerable
Ubuntulxml18.044.2.1-1ubuntu0.1vulnerable
Ubuntulxml18.044.2.1-1ubuntu0.2vulnerable
Ubuntulxml18.044.2.1-1ubuntu0.3vulnerable
Ubuntulxml18.044.2.1-1ubuntu0.4fixed
Ubuntulxml20.044.4.1-1vulnerable
Ubuntulxml20.044.4.1-1build1vulnerable
Ubuntulxml20.044.4.2-1vulnerable
Ubuntulxml20.044.5.0-1vulnerable
Ubuntulxml20.044.5.0-1ubuntu0.1vulnerable
Ubuntulxml20.044.5.0-1ubuntu0.2vulnerable
Ubuntulxml20.044.5.0-1ubuntu0.3fixed
Ubuntulxmlpro3.2.0-1vulnerable
Ubuntulxmlpro3.3.0~beta2-1vulnerable
Ubuntulxmlpro3.3.0~beta4-1vulnerable
Ubuntulxmlpro3.3.1-1vulnerable
Ubuntulxmlpro3.3.2-1vulnerable
Ubuntulxmlpro3.3.2-1build1vulnerable
Ubuntulxmlpro3.3.3-1vulnerable
Ubuntulxmlpro3.3.3-1ubuntu0.1vulnerable
Ubuntulxmlpro3.3.3-1ubuntu0.2vulnerable
Ubuntulxmlpro3.3.3-1ubuntu0.2+esm1vulnerable
Ubuntulxmlpro3.3.3-1ubuntu0.2+esm2vulnerable
Ubuntulxmlpro3.3.3-1ubuntu0.2+esm3fixed
Susepython3-lxmllinux enterprise module for public cloud 123.3.5-3.15.1fixed
Opensusetranslate-toolkittumbleweed3.3.6-1.3fixed
Opensusetranslate-toolkittumbleweed3.14.5-1.1fixed
Ubuntulxmlpro3.2.0-1vulnerable
Ubuntulxmlpro3.3.0~beta2-1vulnerable
Ubuntulxmlpro3.3.0~beta4-1vulnerable
Ubuntulxmlpro3.3.1-1vulnerable
Ubuntulxmlpro3.3.2-1vulnerable
Ubuntulxmlpro3.3.2-1build1vulnerable
Ubuntulxmlpro3.3.3-1vulnerable
Ubuntulxmlpro3.3.3-1ubuntu0.1vulnerable
Ubuntulxmlpro3.3.3-1ubuntu0.2vulnerable
Ubuntulxmlpro3.3.3-1ubuntu0.2+esm1vulnerable
Ubuntulxmlpro3.3.3-1ubuntu0.2+esm2vulnerable
Ubuntulxmlpro3.3.3-1ubuntu0.2+esm3fixed
Ubuntulxml16.043.4.4-1vulnerable
Ubuntulxml16.043.5.0-1vulnerable
Ubuntulxml16.043.5.0-1build1vulnerable
Ubuntulxml16.043.5.0-1ubuntu0.1vulnerable
Ubuntulxml16.043.5.0-1ubuntu0.2vulnerable
Ubuntulxml16.043.5.0-1ubuntu0.3vulnerable
Ubuntulxml16.043.5.0-1ubuntu0.4fixed
Ubuntulxml18.044.0.0-1vulnerable
Ubuntulxml18.044.1.0-1vulnerable
Ubuntulxml18.044.2.0-1vulnerable
Ubuntulxml18.044.2.1-1vulnerable
Ubuntulxml18.044.2.1-1ubuntu0.1vulnerable
Ubuntulxml18.044.2.1-1ubuntu0.2vulnerable
Ubuntulxml18.044.2.1-1ubuntu0.3vulnerable
Ubuntulxml18.044.2.1-1ubuntu0.4fixed
Ubuntulxml20.044.4.1-1vulnerable
Ubuntulxml20.044.4.1-1build1vulnerable
Ubuntulxml20.044.4.2-1vulnerable
Ubuntulxml20.044.5.0-1vulnerable
Ubuntulxml20.044.5.0-1ubuntu0.1vulnerable
Ubuntulxml20.044.5.0-1ubuntu0.2vulnerable
Ubuntulxml20.044.5.0-1ubuntu0.3fixed
Susepython3-lxmllinux enterprise server 12 sp53.6.1-3.6.1fixed
Susepython3-lxmllinux enterprise server for sap applications 12 sp53.6.1-3.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlxmlsourcesid4.6.3-1not yet assignedNot reported[985643]
Debianlxmlsourceforky4.6.3-1not yet assignedNot reported[985643]
Debianlxmlsourcetrixie4.6.3-1not yet assignedNot reported[985643]
Debianlxmlsourcebookworm4.6.3-1not yet assignedNot reported[985643]
Alpinepy3-lxmlapk3.164.6.3-r0Not reportedALPINE-CVE-2021-28957Not reported
Alpinepy3-lxmlapk3.174.6.3-r0Not reportedALPINE-CVE-2021-28957Not reported
Alpinepy3-lxmlapk3.184.6.3-r0Not reportedALPINE-CVE-2021-28957Not reported
Alpinepy3-lxmlapk3.194.6.3-r0Not reportedALPINE-CVE-2021-28957Not reported
Alpinepy3-lxmlapk3.204.6.3-r0Not reportedALPINE-CVE-2021-28957Not reported
Alpinepy3-lxmlapk3.214.6.3-r0Not reportedALPINE-CVE-2021-28957Not reported
Alpinepy3-lxmlapk3.224.6.3-r0Not reportedALPINE-CVE-2021-28957Not reported
Alpinepy3-lxmlapk3.234.6.3-r0Not reportedALPINE-CVE-2021-28957Not reported
Alpinepy3-lxmlapk3.244.6.3-r0Not reportedALPINE-CVE-2021-28957Not reported
Ubuntulxmldeb16.043.5.0-1ubuntu0.4Not reportedUSN-4896-1Not reported
Ubuntulxmldeb18.044.2.1-1ubuntu0.4Not reportedUSN-4896-1Not reported
Ubuntulxmldeb20.044.5.0-1ubuntu0.3Not reportedUSN-4896-1Not reported
Ubuntulxmldebpro3.3.3-1ubuntu0.2+esm3Not reportedUSN-4896-2Not reported
Susepython3-lxmlrpmlinux enterprise module for public cloud 123.3.5-3.15.1Not reportedSUSE-SU-2022:3934-1Not reported
Opensusetranslate-toolkitrpmtumbleweed3.3.6-1.3Not reportedOPENSUSE-SU-2024:11473-1Not reported
Opensusetranslate-toolkitrpmtumbleweed3.14.5-1.1Not reportedOPENSUSE-SU-2025:14647-1Not reported
Ubuntulxmldebpro3.3.3-1ubuntu0.2+esm3Not reportedUBUNTU-CVE-2021-28957Not reported
Ubuntulxmldeb16.043.5.0-1ubuntu0.4Not reportedUBUNTU-CVE-2021-28957Not reported
Ubuntulxmldeb18.044.2.1-1ubuntu0.4Not reportedUBUNTU-CVE-2021-28957Not reported
Ubuntulxmldeb20.044.5.0-1ubuntu0.3Not reportedUBUNTU-CVE-2021-28957Not reported
Susepython3-lxmlrpmlinux enterprise server 12 sp53.6.1-3.6.1Not reportedSUSE-SU-2022:3937-1Not reported
Susepython3-lxmlrpmlinux enterprise server for sap applications 12 sp53.6.1-3.6.1Not reportedSUSE-SU-2022:3937-1Not reported

[Debian bug #985643]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [python313-translate-toolkit]Unknown

    Source package: [translate-toolkit]

    Details (1)

    • 3.19.9-1.2 · noarch · tumbleweed

      Unknown · Fixed: 3.14.5-1.1, 3.3.6-1.3

      Version impact unknown

      dsa · translate-toolkit · opensuse · tumbleweed

  • [python314-translate-toolkit]Unknown

    Source package: [translate-toolkit]

    Details (1)

    • 3.19.9-1.2 · noarch · tumbleweed

      Unknown · Fixed: 3.14.5-1.1, 3.3.6-1.3

      Version impact unknown

      dsa · translate-toolkit · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [python3-lxml]Fixed

    Source package: [lxml]

    Details (2)

    • 4.9.2-1+b1 · amd64 · bookworm

      Fixed · Fixed: 4.6.3-1

      dsa · lxml · debian · bookworm; dsa · lxml · debian · 12

    • 4.9.2-1+b1 · arm64 · bookworm

      Fixed · Fixed: 4.6.3-1

      dsa · lxml · debian · bookworm; dsa · lxml · debian · 12

  • [python-lxml-doc]Fixed

    Source package: [lxml]

    Details (2)

    • 4.9.2-1 · all · bookworm

      Fixed · Fixed: 4.6.3-1

      dsa · lxml · debian · bookworm; dsa · lxml · debian · 12

    • 4.9.2-1 · all · bookworm

      Fixed · Fixed: 4.6.3-1

      dsa · lxml · debian · bookworm; dsa · lxml · debian · 12

[Debian 13 (Trixie)]

  • [python3-lxml]Fixed

    Source package: [lxml]

    Details (2)

    • 5.4.0-1 · amd64 · trixie

      Fixed · Fixed: 4.6.3-1

      dsa · lxml · debian · 13

    • 5.4.0-1 · arm64 · trixie

      Fixed · Fixed: 4.6.3-1

      dsa · lxml · debian · 13

  • [python-lxml-doc]Fixed

    Source package: [lxml]

    Details (2)

    • 5.4.0-1 · all · trixie

      Fixed · Fixed: 4.6.3-1

      dsa · lxml · debian · 13

    • 5.4.0-1 · all · trixie

      Fixed · Fixed: 4.6.3-1

      dsa · lxml · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]