lxml@3.3.0 vulnerabilities

Affected versions of this package are vulnerable to NULL Pointer Dereference in the iterwalk() function (used by canonicalize) that can be triggered by malicious input.

NOTE: This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14.

Upgrade lxml to version 4.9.1 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs.

Upgrade lxml to version 4.6.5 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via formaction attribute in HTML5.

Upgrade lxml to version 4.6.3 or higher.

Affected versions of this package are vulnerable to Arbitrary File Write. When writing to file paths that contain the URL escape character '%', the file path could wrongly be mangled by URL unescaping and thus write to a different file or directory.

Upgrade lxml to version 4.4.0 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The HTML Cleaner allowed JavaScript to pass through. The cleaner now removes more sneaky "style" content.

Upgrade lxml to version 4.6.2 or higher.

lxml is a Pythonic, mature binding for the libxml2 and libxslt libraries.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks. Due to an improper escaping, an attacker could perform XSS attack in Internet Explorer.

Upgrade lxml to version 4.2.5 or higher.

lxml is a Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API. Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.