CVE-2021-43818

—

CVSS 3.1

7.1 high

EPSS

2%p84

Published

Dec 13, 2021 (Dec 13, 2021)

Modified

Jun 17, 2026

Description

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

Vendors: lxml fedoraproject debian netapp oracle
Products: lxml, fedora, debian linux, solidfire, solidfire enterprise sds, hci storage node firmware, communications cloud native core binding support function, communications cloud native core network exposure function, communications cloud native core policy, http server, zfs storage appliance kit
Weakness: CWE-74, CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news0 stories

No ingested article mentions this CVE yet.