{"id":"CVE-2014-3146","aliases":["DEBIAN-CVE-2014-3146","DLA-0009-1","DSA-2941-1","EUVD-2014-0033","GHSA-57qw-cc2g-pv5p","MGASA-2014-0218","PYSEC-2014-9","UBUNTU-CVE-2014-3146","USN-2217-1"],"status":"published","title":"lxml Cross-site Scripting Via Control Characters","description":"Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06333,"percentile":0.93676,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2014-05-14T00:00:00Z","modified":"2026-10-23T16:02:16Z","exploits":[{"source":"exploitdb","id":"EDB-39155","title":"lxml - 'clean_html' Security Bypass","type":"remote","platform":"linux","date":"2014-04-15","verified":true,"url":"https://www.exploit-db.com/exploits/39155"}],"fixes":[{"ecosystem":"PyPI","package":"lxml","fixed_in":["3.3.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"lxml","fixed_in":["3.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lxml","fixed_in":["3.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lxml","fixed_in":["3.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"lxml","fixed_in":["2.2.8-2+deb6u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"lxml","fixed_in":["2.3.2-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"python-lxml","fixed_in":["3.0.1-2.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"python-lxml","fixed_in":["3.2.4-1.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"lxml","fixed_in":["3.3.3-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-2+deb6u1"}]}],"versions":["2.2.8-2"]},{"source":"osv","ecosystem":"Debian:7","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1+deb7u1"}]}],"versions":["2.3.2-1"]},{"source":"osv","ecosystem":"PyPI","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5"}]}],"versions":["1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","2.0","2.0.10","2.0.11","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","3.0","3.0.2","3.1.0","3.1.1","3.1.2","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4"]},{"source":"osv","ecosystem":"Mageia:3","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-2.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1.1.mga4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5"}]}],"versions":["0.9","0.9.1","0.9.2","1.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.beta","1.1","1.1.1","1.1.2","1.1alpha","1.1beta","1.2","1.2.1","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3beta","2.0","2.0.1","2.0.10","2.0.11","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0alpha1","2.0alpha2","2.0alpha3","2.0alpha4","2.0alpha5","2.0alpha6","2.0beta1","2.0beta2","2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1alpha1","2.1beta1","2.1beta2","2.1beta3","2.2","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2alpha1","2.2beta1","2.2beta2","2.2beta3","2.2beta4","2.3","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3alpha1","2.3alpha2","2.3beta1","3.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1beta1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3.0","3.3.0beta1","3.3.0beta2","3.3.0beta3","3.3.0beta4","3.3.0beta5","3.3.1","3.3.2","3.3.3","3.3.4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1ubuntu0.1"}]}],"versions":["3.2.0-1","3.3.0~beta2-1","3.3.0~beta4-1","3.3.1-1","3.3.2-1","3.3.2-1build1","3.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1ubuntu0.1"}]}],"versions":["3.2.0-1","3.3.0~beta2-1","3.3.0~beta4-1","3.3.1-1","3.3.2-1","3.3.2-1build1","3.3.3-1"]}],"products":[{"vendor":"lxml","product":"lxml"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-2941","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://lxml.de/3.3/changes-3.3.5.html","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/09/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://www.ubuntu.com/usn/USN-2217-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence","web","report"]},{"url":"http://secunia.com/advisories/58744","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://advisories.mageia.org/MGASA-2014-0218.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/67159","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","evidence","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:112","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/58013","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://seclists.org/fulldisclosure/2014/Apr/210","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web","report"]},{"url":"http://secunia.com/advisories/59008","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00083.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2014/Apr/319","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","evidence","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3146","tags":["advisory"]},{"url":"https://github.com/lxml/lxml/pull/273","tags":["web"]},{"url":"https://github.com/lxml/lxml/commit/3f3082e0a67851cde26a48da3d1f4b75d8aa07ec","tags":["web"]},{"url":"https://github.com/lxml/lxml/commit/86e81ab393ba14c1be71284675851a3bdce57d69","tags":["web"]},{"url":"https://github.com/lxml/lxml/commit/e86b294f1f81b899a59925123560ff924a72f1cc","tags":["web"]},{"url":"https://web.archive.org/web/20140724172044/http://secunia.com/advisories/58013","tags":["web"]},{"url":"https://web.archive.org/web/20140805110535/http://secunia.com/advisories/59008","tags":["web"]},{"url":"https://web.archive.org/web/20140806061046/http://secunia.com/advisories/58744","tags":["web"]},{"url":"https://web.archive.org/web/20141017122607/https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html","tags":["web"]},{"url":"https://web.archive.org/web/20150523055039/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:112/?name=MDVSA-2015:112","tags":["web"]},{"url":"https://web.archive.org/web/20200228180542/http://www.securityfocus.com/bid/67159","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2014-9.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-57qw-cc2g-pv5p","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3146","tags":["advisory"]},{"url":"https://github.com/lxml/lxml","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0218.html","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/132472.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3146","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2217-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3146","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-3146","description":"Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.","status":"published","published":"2014-05-14T19:00:00Z","modified":"2025-12-17T21:03:02.761Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-0033","description":"Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.","status":"published","published":"2014-05-14T19:00:00Z","modified":"2025-12-17T21:03:02Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:03.481924Z"}],"ghsa":[{"id":"GHSA-57qw-cc2g-pv5p","title":"lxml Cross-site Scripting Via Control Characters","description":"Incomplete blacklist vulnerability in the `lxml.html.clean` module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the `clean_html` function.","status":"published","published":"2022-05-14T04:01:59Z","modified":"2024-09-30T17:03:33Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:06.988799Z"}],"nvd":[{"id":"CVE-2014-3146","description":"Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.","status":"published","published":"2014-05-14T19:55:11.653Z","modified":"2026-06-17T00:07:40.07Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"DEBIAN-CVE-2014-3146","description":"Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.","status":"published","published":"2014-05-14T19:55:11.653Z","modified":"2026-10-23T16:02:16.856768162Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"GHSA-57qw-cc2g-pv5p","title":"lxml Cross-site Scripting Via Control Characters","description":"Incomplete blacklist vulnerability in the `lxml.html.clean` module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the `clean_html` function.","status":"published","published":"2022-05-14T04:01:59Z","modified":"2024-09-30T17:23:00.823195Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"UBUNTU-CVE-2014-3146","description":"Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.","status":"published","published":"2014-05-14T00:00:00Z","modified":"2026-02-04T02:42:43.43684Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"CVE-2014-3146","description":"Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.","status":"published","published":"2014-05-14T19:55:11Z","modified":"2026-04-16T06:23:35.726770915Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DLA-0009-1","title":"lxml - security update","status":"published","published":"2014-06-26T00:00:00Z","modified":"2026-03-09T01:00:55.945362Z","updated_at":"2026-11-02T15:46:08.746073Z"},{"id":"DSA-2941-1","title":"lxml - security update","status":"published","published":"2014-06-01T00:00:00Z","modified":"2026-03-09T01:21:09.484913Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0218","title":"Updated python-lxml package fix CVE-2014-3146","description":"Updated python-lxml packages fix security vulnerability:\n\nThe clean_html() function, provided by the lxml.html.clean module, did not\nproperly clean HTML input if it included non-printed characters (\\x01-\\x08).\nA remote attacker could use this flaw to serve malicious content to an\napplication using the clean_html() function to process HTML, possibly\nallowing the attacker to inject malicious code into a website generated by\nthis application (CVE-2014-3146).\n","status":"published","published":"2014-05-14T22:10:47Z","modified":"2026-04-16T06:22:39.657038255Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"PYSEC-2014-9","description":"Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.","status":"published","published":"2014-05-14T19:55:00Z","modified":"2026-06-10T17:00:40.512273712Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"USN-2217-1","title":"lxml vulnerability","description":"It was discovered that the lxml.html.clean module incorrectly stripped\ncontrol characters. An attacked could potentially exploit this to conduct\ncross-site scripting (XSS) attacks.\n","status":"published","published":"2014-05-21T15:23:53Z","modified":"2026-02-10T04:40:49Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}