CVE-2021-43818 HTML Cleaner allows crafted and SVG embedded scripts to pass through
Attackers can inject malicious scripts via crafted HTML or embedded SVGs, leading to XSS, affecting users of the lxml library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-43818?
CVE-2021-43818 is a high-severity cross-site scripting vulnerability in Debian Debian Linux, published on 13 Dec 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.
Which versions are affected by CVE-2021-43818?
3 open source packages ship an affected version, including lxml. It affects 11 products.
| Package | Affected | Fixed in |
|---|---|---|
lxml PyPI | All versions | 4.6.5 |
lxml PyPI | All versions | 4.6.5 |
lxml PyPI | All versions | 4.6.5 |
Linux distribution packages (37)
python3-lxml AlmaLinux:8 | All versions | 4.2.3-4.el8 |
python39 AlmaLinux:8 | All versions | 3.9.7-1.module_el8.6.0+2780+a40f65e1 |
python39-Cython AlmaLinux:8 | All versions | 0.29.21-5.module_el8.6.0+2780+a40f65e1 |
python39-PyMySQL AlmaLinux:8 | All versions | 0.10.1-2.module_el8.6.0+2780+a40f65e1 |
python39-attrs AlmaLinux:8 | All versions | 20.3.0-2.module_el8.6.0+2780+a40f65e1 |
python39-cffi AlmaLinux:8 | All versions | 1.14.3-2.module_el8.6.0+2780+a40f65e1 |
python39-chardet AlmaLinux:8 | All versions | 3.0.4-19.module_el8.6.0+2780+a40f65e1 |
python39-cryptography AlmaLinux:8 | All versions | 3.3.1-2.module_el8.6.0+2780+a40f65e1 |
python39-debug AlmaLinux:8 | All versions | 3.9.7-1.module_el8.6.0+2780+a40f65e1 |
python39-devel AlmaLinux:8 | All versions | 3.9.7-1.module_el8.6.0+2780+a40f65e1 |
python39-idle AlmaLinux:8 | All versions | 3.9.7-1.module_el8.6.0+2780+a40f65e1 |
python39-idna AlmaLinux:8 | All versions | 2.10-3.module_el8.6.0+2780+a40f65e1 |
python39-iniconfig AlmaLinux:8 | All versions | 1.1.1-2.module_el8.6.0+2780+a40f65e1 |
python39-libs AlmaLinux:8 | All versions | 3.9.7-1.module_el8.6.0+2780+a40f65e1 |
python39-lxml AlmaLinux:8 | All versions | 4.6.5-1.module_el8.6.0+2780+a40f65e1 |
python39-mod_wsgi AlmaLinux:8 | All versions | 4.7.1-4.module_el8.6.0+2780+a40f65e1 |
python39-more-itertools AlmaLinux:8 | All versions | 8.5.0-2.module_el8.6.0+2780+a40f65e1 |
python39-numpy AlmaLinux:8 | All versions | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
python39-numpy-doc AlmaLinux:8 | All versions | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
python39-numpy-f2py AlmaLinux:8 | All versions | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
python39-packaging AlmaLinux:8 | All versions | 20.4-4.module_el8.6.0+2780+a40f65e1 |
python39-pip AlmaLinux:8 | All versions | 20.2.4-7.module_el8.6.0+2780+a40f65e1 |
python39-pip-wheel AlmaLinux:8 | All versions | 20.2.4-7.module_el8.6.0+2780+a40f65e1 |
python39-pluggy AlmaLinux:8 | All versions | 0.13.1-3.module_el8.6.0+2780+a40f65e1 |
python39-ply AlmaLinux:8 | All versions | 3.11-10.module_el8.6.0+2780+a40f65e1 |
python39-psutil AlmaLinux:8 | All versions | 5.8.0-4.module_el8.6.0+2780+a40f65e1 |
python39-psycopg2 AlmaLinux:8 | All versions | 2.8.6-2.module_el8.6.0+2780+a40f65e1 |
python39-psycopg2-doc AlmaLinux:8 | All versions | 2.8.6-2.module_el8.6.0+2780+a40f65e1 |
python39-psycopg2-tests AlmaLinux:8 | All versions | 2.8.6-2.module_el8.6.0+2780+a40f65e1 |
python39-py AlmaLinux:8 | All versions | 1.10.0-1.module_el8.6.0+2780+a40f65e1 |
python39-pybind11 AlmaLinux:8 | All versions | 2.7.1-1.module_el8.6.0+2780+a40f65e1 |
python39-pybind11-devel AlmaLinux:8 | All versions | 2.7.1-1.module_el8.6.0+2780+a40f65e1 |
python39-pycparser AlmaLinux:8 | All versions | 2.20-3.module_el8.6.0+2780+a40f65e1 |
python39-pyparsing AlmaLinux:8 | All versions | 2.4.7-5.module_el8.6.0+2780+a40f65e1 |
python39-pysocks AlmaLinux:8 | All versions | 1.7.1-4.module_el8.6.0+2780+a40f65e1 |
python39-pytest AlmaLinux:8 | All versions | 6.0.2-2.module_el8.6.0+2780+a40f65e1 |
python39-pyyaml AlmaLinux:8 | All versions | 5.4.1-1.module_el8.6.0+2780+a40f65e1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Lxml Lxml, Netapp Hci Storage Node Firmware, Netapp Solidfire, Netapp Solidfire Enterprise Sds and 5 more.
How do I fix CVE-2021-43818?
Upgrade lxml to 4.6.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-43818 being exploited?
There is no known exploitation of CVE-2021-43818 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-43818, ALSA-2022:1763, ALSA-2022:1932, AZL-7025, CLSA-2024-1729629058, CLSA-2026-1792442901 and 15 more.