QwikSec

Security Database

CVE

CWE

Training

CVE-2018-19787

Published: Dec 2, 2018

Modified: Dec 18, 2025

PUBLISHED

Description

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vendor-advisory

x_refsource_UBUNTU

[debian-lts-announce] 20181210 [SECURITY] [DLA 1604-1] lxml security update

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_UBUNTU

https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109

x_refsource_MISC

[debian-lts-announce] 20201126 [SECURITY] [DLA 2467-1] lxml security update

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.