CVE-2026-28350

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for <base>, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
fedora-python	lxml_html_clean	< 0.4.4

References

https://github.com/fedora-python/lxml_html_clean/commit/9c5612ca33b941eec4178abf8a5294b103403f34Patch
https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-xvp8-3mhv-424cExploit, Vendor Advisory
https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-xvp8-3mhv-424cExploit, Vendor Advisory

Timeline

Published: Mar 5, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-283515.3pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF whi CVE-2026-283526.5Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11 CVE-2026-2835310.0Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was dist CVE-2026-283546.5ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorizati CVE-2026-283551.3Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in CVE-2026-283567.5multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multi CVE-2026-283575.4NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtua CVE-2026-283585.3NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different respons CVE-2026-283595.4NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbit CVE-2026-28368.1A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs becaus CVE-2026-283605.3NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the d CVE-2026-283616.3NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership,