CVE-2021-28957: Debian Linux

Medium severity, CVSS 6.1. EPSS: 4% chance of exploitation in the next 30 days.

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Lxml Lxml: before 4.6.3 (fixed in 4.6.3)
• Netapp Snapcenter: affected versions not specified
• Oracle ZFS Storage Appliance Kit: version 8.8 only

Published 2021-03-21. Last modified 2026-06-17.