CVE-2021-43818

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-79

Affected software

VendorProductVersions
lxmllxml< 4.6.5

References

Timeline

Published
Dec 13, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-438195.3Stargate-Bukkit is a mod for the minecraft video game which adds a portal focused environment. In affected versions Minecarts with chests wiCVE-2021-43828.8The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() CVE-2021-438205.9Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. TCVE-2021-438217.7Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to localCVE-2021-438227.5Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affecCVE-2021-438236.5Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where stringsCVE-2021-438247.5Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes EnvoyCVE-2021-438257.5Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop furthCVE-2021-438267.5Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when coCVE-2021-438274.3discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tagsCVE-2021-438287.5PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.77 an improper privilege managementCVE-2021-438298.8PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlManager unrestrictly han
CVE-2021-43818: High severity, CVSS 7.1 | Vulnix