CVE-2026-28350mediumCWE-116

CVE-2026-28350: falha de média gravidade em fedora-python lxml_html_clean

lxml_html_clean: <base> tag injection through default Cleaner configuration

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar lxml html clean+ Monitorar lxml

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.3%
lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for <base>, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
fedora-python · lxml_html_clean
CVEs relacionadas — fedora-python lxml_html_clean

No mesmo produto, das mais perigosas para as menos.

CVE-2024-52595HIGHHTML Cleaner allows crafted scripts in special contexts like svg or math to pass throughEPSS 0.5%CVE-2026-49825HIGHlxml: javascript: URL bypass in Cleaner via xlink:hrefEPSS 0.3%CVE-2026-28348MEDIUMlxml_html_clean: CSS @import Filter Bypass via Unicode EscapesEPSS 0.3%