CVE-2024-52595

Advisory

Affected versions of lxml_html_clean are vulnerable to Cross-Site Scripting (CWE-79). This vulnerability allows attackers to inject malicious scripts within CSS comments in special HTML tags like <svg>, <math>, and <noscript>, potentially executing harmful code in users' browsers. The attack vector involves crafting HTML content that bypasses the sanitizer by exploiting improper handling of CSS comments. To mitigate, upgrade to lxml_html_clean version 0.4.0 or later, or configure the cleaner to remove or restrict context-switching tags such as <svg>, <math>, and <noscript>.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-5jfw-gq64-q45f
• https://github.com/fedora-python/lxml_html_clean/commit/c5d816f86eb3707d72a8ecf5f3823e0daa1b3808
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52595