This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-27783 →

DEBIAN-CVE-2020-27783

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behavio...

Original description

The description as published by the source.

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 lxml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-1"}]}]

Debian:13 lxml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-1"}]}]

Debian:14 lxml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-1"}]}]

References

advisory security-tracker.debian.org