CVE-2021-28957: lxml +4 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-28957

CVSS 6.1 · Medium EPSS 4,0%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada lxml, debian linux +3 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Rincian

Terbit di NVD: 21 Maret 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 4,0% peluang dieksploitasi; lebih tinggi dari 90,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lxml	lxml	Semua versi sebelum 4.6.3
debian	debian linux	Versi 9.0
debian	debian linux	Versi 10.0
fedoraproject	fedora	Versi 33
fedoraproject	fedora	Versi 34
netapp	snapcenter	Semua versi
oracle	zfs storage appliance kit	Versi 8.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999 patch · advisory pihak ketiga
https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270 patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
https://bugs.launchpad.net/lxml/+bug/1888153 exploit · issue tracking · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202208-06 advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20210521-0004/ advisory pihak ketiga
https://www.debian.org/security/2021/dsa-4880 advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3C2R44VDUY7FJ...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXN3QPWCTQVOG...

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.