Homepage
About Snyk

lxml@4.1.0 vulnerabilities

Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the lxml package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
NULL Pointer Dereference

Affected versions of this package are vulnerable to NULL Pointer Dereference in the iterwalk() function (used by canonicalize) that can be triggered by malicious input.

NOTE: This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14.

How to fix NULL Pointer Dereference?

Upgrade lxml to version 4.9.1 or higher.

[,4.9.1)
  • H
Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs.

How to fix Cross-site Scripting (XSS)?

Upgrade lxml to version 4.6.5 or higher.

[,4.6.5)
  • M
Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via formaction attribute in HTML5.

How to fix Cross-site Scripting (XSS)?

Upgrade lxml to version 4.6.3 or higher.

[0,4.6.3)
  • M
Arbitrary File Write

Affected versions of this package are vulnerable to Arbitrary File Write. When writing to file paths that contain the URL escape character '%', the file path could wrongly be mangled by URL unescaping and thus write to a different file or directory.

How to fix Arbitrary File Write?

Upgrade lxml to version 4.4.0 or higher.

[,4.4.0)
  • H
Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The HTML Cleaner allowed JavaScript to pass through. The cleaner now removes more sneaky "style" content.

How to fix Cross-site Scripting (XSS)?

Upgrade lxml to version 4.6.2 or higher.

[,4.6.2)
  • M
Cross-site Scripting (XSS)

lxml is a Pythonic, mature binding for the libxml2 and libxslt libraries.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks. Due to an improper escaping, an attacker could perform XSS attack in Internet Explorer.

How to fix Cross-site Scripting (XSS)?

Upgrade lxml to version 4.2.5 or higher.

[,4.2.5)
Go back to all versions of this package