🛡️ CVE-2021-43818 — lxml
Description
lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through
Impact
The HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs.
Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5.
Patches
The issue has been resolved in lxml 4.6.5.
Workarounds
None.
References
The issues are tracked under the report IDs GHSL-2021-1037 and GHSL-2021-1038.
How this vulnerability can be exploited
This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. A user must be tricked into taking some action. Rated impact: confidentiality none, integrity none, availability none.
Affected software
CVE-2021-43818 is recorded against 1 package.
- lxml (fixed in 4.6.5)
Timeline and source
Published on 13 December 2021 and last revised on 8 July 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from OSV.
References
github.com (Web)
nvd.nist.gov (Advisory)
github.com (Web)
github.com (Web)
github.com (Web)
www.oracle.com (Web)
www.oracle.com (Web)
www.debian.org (Web)
security.netapp.com (Web)
security.gentoo.org (Web)
lists.fedoraproject.org (Web)
lists.fedoraproject.org (Web)
lists.fedoraproject.org (Web)
lists.fedoraproject.org (Web)
lists.debian.org (Web)
CVE-2021-43818 on other distributions
Each distribution ships its own build and its own fixed version. Pick the one you run:
Details
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| lxml | — | 4.6.5 |
References
Similar Threats
- Unknown CLSA-2026-1779151640
- Unknown CLSA-2026-1779238041
- Medium ROOT-APP-PYPI-CVE-2026-41066
- Unknown ECHO-e83f-9e30-4171
- Unknown DEBIAN-CVE-2026-41066
More CVE 2021 advisories
Browse all of CVE 2021 in the advisory index.
Free Vulnerability Check
Is your site affected by CVE-2021-43818?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against CVE-2021-43818 and other known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.