CVE-2014-3146
lxml Cross-site Scripting Via Control Characters
CVE-2014-3146 is a medium vulnerability (CVSS 4.3) in Lxml, published May 14, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.33%, the 93rd percentile. Fixed in lxml 3.3.5.
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
Exploit likelihood
What each source reports
CVE List
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
- Record
CVE-2014-3146- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2014-0033
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
- Record
EUVD-2014-0033- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-57qw-cc2g-pv5p
lxml Cross-site Scripting Via Control Characters
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
- Record
GHSA-57qw-cc2g-pv5p- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
- Record
CVE-2014-3146- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3146
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
- Record
DEBIAN-CVE-2014-3146- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-57qw-cc2g-pv5p
lxml Cross-site Scripting Via Control Characters
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
- Record
GHSA-57qw-cc2g-pv5p- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2014-3146
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
- Record
UBUNTU-CVE-2014-3146- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSV No score
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
- Record
CVE-2014-3146- Updated
- 2026-11-02
OSVMGASA-2014-0218 No score
Updated python-lxml package fix CVE-2014-3146
Updated python-lxml packages fix security vulnerability:
The clean_html() function, provided by the lxml.html.clean module, did not properly clean HTML input if it included non-printed characters (\x01-\x08). A remote attacker could use this flaw to serve malicious content to an application using the clean_html() function to process HTML, possibly allowing the attacker to inject malicious code into a website generated by this application (CVE-2014-3146).
- Record
MGASA-2014-0218- Updated
- 2026-11-02
OSVPYSEC-2014-9 No score
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
- Record
PYSEC-2014-9- Updated
- 2026-11-02
OSVUSN-2217-1 No score
lxml vulnerability
It was discovered that the lxml.html.clean module incorrectly stripped control characters. An attacked could potentially exploit this to conduct cross-site scripting (XSS) attacks.
- Record
USN-2217-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lxmlPyPI |
before 3.3.5 | 3.3.5 |
lxmlDebian:12 |
before 3.3.5-1 | 3.3.5-1 |
lxmlDebian:13 |
before 3.3.5-1 | 3.3.5-1 |
lxmlDebian:14 |
before 3.3.5-1 | 3.3.5-1 |
lxmlDebian:6.0 |
before 2.2.8-2+deb6u1, plus listed versions 2.2.8-2 |
2.2.8-2+deb6u1 |
lxmlDebian:7 |
before 2.3.2-1+deb7u1, plus listed versions 2.3.2-1 |
2.3.2-1+deb7u1 |
lxmlPyPI |
before 3.3.5, plus listed versions 1.3.21.3.31.3.41.3.51.3.6 Show 45 moreShow less2.02.0.102.0.112.0.42.0.52.0.62.0.72.0.82.0.92.12.1.12.1.22.1.32.1.42.1.52.22.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.32.3.12.3.22.3.32.3.42.3.52.3.63.03.0.23.1.03.1.13.1.23.2.03.2.13.2.23.2.33.2.43.2.53.3.03.3.13.3.2 |
3.3.5 |
python-lxmlMageia:3 |
before 3.0.1-2.1.mga3 | 3.0.1-2.1.mga3 |
python-lxmlMageia:4 |
before 3.2.4-1.1.mga4 | 3.2.4-1.1.mga4 |
lxmlPyPI |
before 3.3.5, plus listed versions 0.90.9.10.9.21.01.0.1 Show 45 moreShow less1.0.21.0.31.0.41.0.beta1.11.1.11.1.21.1alpha1.1beta1.21.2.11.31.3.11.3.21.3.31.3.41.3.51.3.61.3beta2.02.0.12.0.102.0.112.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.0alpha12.0alpha22.0alpha32.0alpha42.0alpha52.0alpha62.0beta12.0beta22.12.1.12.1.22.1.32.1.42.1.5 |
3.3.5 |
lxmlUbuntu:14.04:LTS |
before 3.3.3-1ubuntu0.1, plus listed versions 3.2.0-13.3.0~beta2-13.3.0~beta4-13.3.1-13.3.2-13.3.2-1build13.3.3-1 |
3.3.3-1ubuntu0.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | lxml - 'clean_html' Security Bypass | 2014-04-15 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD, OSV |
References
debian.org/security/2014/dsa-2941
lxml.de/3.3/changes-3.3.5.html
openwall.com/lists/oss-security/2014/05/09/7
ubuntu.com/usn/USN-2217-1
mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html
secunia.com/advisories/58744
Show 28 moreShow less
advisories.mageia.org/MGASA-2014-0218.html
securityfocus.com/bid/67159
mandriva.com/security/advisories?name=MDVSA-2015:112
seclists.org/fulldisclosure/2014/Apr/210
lists.opensuse.org/opensuse-updates/2014-05/msg00083.html
nvd.nist.gov/vuln/detail/CVE-2014-3146
github.com/lxml/lxml/pull/273
web.archive.org/web/20140724172044/http://secunia.com/advisories/58013
security-tracker.debian.org/tracker/CVE-2014-3146
lists.fedoraproject.org/pipermail/package-announce/2014-May/132472.html
bugs.mageia.org/show_bug.cgi?id=13326
ubuntu.com/security/CVE-2014-3146
cve.org/CVERecord?id=CVE-2014-3146
Left out here: 53 versions. The JSON record has them.