CVE-2021-43818: Debian Linux

High severity, CVSS 7.1. EPSS: 2.7% chance of exploitation in the next 30 days.

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Lxml Lxml: before 4.6.5 (fixed in 4.6.5)
• Netapp Hci Storage Node Firmware: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Netapp Solidfire Enterprise Sds: affected versions not specified
• Oracle Communications Cloud Native Core Binding Support Function: version 22.1.3 only
• Oracle Communications Cloud Native Core Network Exposure Function: version 22.1.1 only
• Oracle Communications Cloud Native Core Policy: version 22.2.0 only
• Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only

Published 2021-12-13. Last modified 2026-06-17.