{"id":"CVE-2026-28350","aliases":["DEBIAN-CVE-2026-28350","EUVD-2026-20098","GHSA-xvp8-3mhv-424c","PYSEC-2026-2202","UBUNTU-CVE-2026-28350","openSUSE-SU-2026:10322-1","openSUSE-SU-2026:20345-1"],"status":"published","title":"lxml_html_clean: \u003cbase\u003e tag injection through default Cleaner configuration","description":"lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the \u003cbase\u003e tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for \u003cbase\u003e, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00296,"percentile":0.22462,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2026-03-02T19:35:52Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"PyPI","package":"lxml-html-clean","fixed_in":["0.4.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"lxml","fixed_in":["4.9.2-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lxml","fixed_in":["5.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lxml","fixed_in":["5.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lxml-html-clean","fixed_in":["0.4.4-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lxml-html-clean","fixed_in":["0.4.4-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.3"},{"fixed":"0.4.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-1+deb12u1"}]}],"versions":["4.9.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1~deb13u1"}]}],"versions":["0.4.2-1","0.4.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1"}]}],"versions":["0.4.2-1","0.4.3-1","0.4.4-1~deb13u1"]},{"source":"osv","ecosystem":"PyPI","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3"]},{"source":"osv","ecosystem":"PyPI","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0-0ubuntu1","0.1.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.1-1","0.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.4-1","0.4.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.2-1","0.4.3-1","0.4.4-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-lxml_html_clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-lxml_html_clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-bp160.2.1"}]}],"bundled":2}],"products":[{"vendor":"fedora-python","product":"lxml_html_clean"},{"vendor":"fedoralovespython","product":"lxml_html_clean"}],"references":[{"url":"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-xvp8-3mhv-424c","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","evidence","report"]},{"url":"https://github.com/fedora-python/lxml_html_clean/commit/9c5612ca33b941eec4178abf8a5294b103403f34","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28350","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xvp8-3mhv-424c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28350.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-28350","tags":["advisory"]},{"url":"https://github.com/fedora-python/lxml_html_clean","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-28350","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28350","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28350","tags":["web"]},{"url":"https://bugzilla.suse.com/1259378","tags":["report"]},{"url":"https://bugzilla.suse.com/1259379","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-28350","title":"lxml_html_clean: \u003cbase\u003e tag injection through default Cleaner configuration","description":"lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the \u003cbase\u003e tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for \u003cbase\u003e, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.","status":"published","published":"2026-03-05T19:49:55.662Z","modified":"2026-03-06T17:05:13.841Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:20:02.290587Z"}],"euvd":[{"id":"EUVD-2026-20098","description":"lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the \u003cbase\u003e tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for \u003cbase\u003e, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.","status":"published","published":"2026-03-05T19:49:55Z","modified":"2026-03-06T17:05:13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:07.686491Z"}],"ghsa":[{"id":"GHSA-xvp8-3mhv-424c","title":"lxml-html-clean has \u003cbase\u003e tag injection through default Cleaner configuration","description":"### Summary\nThe `\u003cbase\u003e` tag passes through the default `Cleaner` configuration. While `page_structure=True` removes `html`, `head`, and `title` tags, there is no specific handling for `\u003cbase\u003e`, allowing an attacker to inject it and hijack relative links on the page.\n\n### Details\nThe `\u003cbase\u003e` tag is not currently in the `page_structure` kill set. Even though the specification says `\u003cbase\u003e` must be inside `\u003chead\u003e`, browsers accept `\u003cbase\u003e` tags outside of the head.\n\nIf an attacker injects a `\u003cbase\u003e` tag, it changes the base URL for all relative URLs on the page (links, images, scripts) to a domain controlled by the attacker.\n\n### PoC\n```python\nfrom lxml_html_clean import clean_html\n\n# The base tag is preserved in the output\nresult = clean_html('\u003cbase href=\"http://evil.com/\"\u003e\u003ca href=\"/account\"\u003eAccount\u003c/a\u003e')\nprint(result)\n# Output: \u003cdiv\u003e\u003cbase href=\"http://evil.com/\"\u003e...\u003ca href=\"/account\"\u003eAccount\u003c/a\u003e\u003c/div\u003e\n```\n\n### Impact\nThe injection of a `\u003cbase\u003e` tag allows an attacker to hijack the resolution of **all** relative URLs on the page. This results in three critical attack vectors:\n\n1.  **Phishing \u0026 Redirection:** Attackers can redirect user navigation (e.g., `\u003ca href=\"/login\"\u003e`) and form submissions (e.g., `\u003cform action=\"/auth\"\u003e`) to an attacker-controlled domain, effectively stealing credentials or sensitive data without the user realizing they have left the legitimate site.\n2.  **Cross-Site Scripting (XSS):** If the victim application loads JavaScript files using relative paths (e.g., `\u003cscript src=\"assets/app.js\"\u003e`), the browser will attempt to fetch the script from the attacker's domain. This upgrades the vulnerability from HTML injection to full Stored XSS.\n3.  **Defacement:** Relative references to images (`\u003cimg\u003e`) and stylesheets (`\u003clink\u003e`) will be loaded from the attacker's server, allowing for UI redressing or defacement.","status":"published","published":"2026-03-02T19:35:52Z","modified":"2026-03-05T22:49:26Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:39:31.060223Z"}],"nvd":[{"id":"CVE-2026-28350","description":"lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the \u003cbase\u003e tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for \u003cbase\u003e, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.","status":"published","published":"2026-03-05T20:16:16.333Z","modified":"2026-06-17T10:28:27.757Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:12:07.852448Z"}],"osv":[{"id":"CVE-2026-28350","title":"lxml_html_clean: \u003cbase\u003e tag injection through default Cleaner configuration","description":"lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the \u003cbase\u003e tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for \u003cbase\u003e, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.","status":"published","published":"2026-03-05T19:49:55.662Z","modified":"2026-10-28T02:30:55.536698369Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"DEBIAN-CVE-2026-28350","description":"lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the \u003cbase\u003e tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for \u003cbase\u003e, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.","status":"published","published":"2026-03-05T20:16:16.333Z","modified":"2026-10-01T03:03:03.084711456Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-xvp8-3mhv-424c","title":"lxml-html-clean has \u003cbase\u003e tag injection through default Cleaner configuration","description":"### Summary\nThe `\u003cbase\u003e` tag passes through the default `Cleaner` configuration. While `page_structure=True` removes `html`, `head`, and `title` tags, there is no specific handling for `\u003cbase\u003e`, allowing an attacker to inject it and hijack relative links on the page.\n\n### Details\nThe `\u003cbase\u003e` tag is not currently in the `page_structure` kill set. Even though the specification says `\u003cbase\u003e` must be inside `\u003chead\u003e`, browsers accept `\u003cbase\u003e` tags outside of the head.\n\nIf an attacker injects a `\u003cbase\u003e` tag, it changes the base URL for all relative URLs on the page (links, images, scripts) to a domain controlled by the attacker.\n\n### PoC\n```python\nfrom lxml_html_clean import clean_html\n\n# The base tag is preserved in the output\nresult = clean_html('\u003cbase href=\"http://evil.com/\"\u003e\u003ca href=\"/account\"\u003eAccount\u003c/a\u003e')\nprint(result)\n# Output: \u003cdiv\u003e\u003cbase href=\"http://evil.com/\"\u003e...\u003ca href=\"/account\"\u003eAccount\u003c/a\u003e\u003c/div\u003e\n```\n\n### Impact\nThe injection of a `\u003cbase\u003e` tag allows an attacker to hijack the resolution of **all** relative URLs on the page. This results in three critical attack vectors:\n\n1.  **Phishing \u0026 Redirection:** Attackers can redirect user navigation (e.g., `\u003ca href=\"/login\"\u003e`) and form submissions (e.g., `\u003cform action=\"/auth\"\u003e`) to an attacker-controlled domain, effectively stealing credentials or sensitive data without the user realizing they have left the legitimate site.\n2.  **Cross-Site Scripting (XSS):** If the victim application loads JavaScript files using relative paths (e.g., `\u003cscript src=\"assets/app.js\"\u003e`), the browser will attempt to fetch the script from the attacker's domain. This upgrades the vulnerability from HTML injection to full Stored XSS.\n3.  **Defacement:** Relative references to images (`\u003cimg\u003e`) and stylesheets (`\u003clink\u003e`) will be loaded from the attacker's server, allowing for UI redressing or defacement.","status":"published","published":"2026-03-02T19:35:52Z","modified":"2026-09-10T03:50:41.9271557Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"PYSEC-2026-2202","description":"lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the \u003cbase\u003e tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for \u003cbase\u003e, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.","status":"published","published":"2026-03-05T20:16:16.333Z","modified":"2026-07-13T07:15:27.778054869Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-28350","description":"lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the \u003cbase\u003e tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for \u003cbase\u003e, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.","status":"published","published":"2026-03-05T20:16:00Z","modified":"2026-10-17T12:58:07.794689725Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"openSUSE-SU-2026:10322-1","title":"python311-lxml_html_clean-0.4.4-1.1 on GA media","description":"These are all security issues fixed in the python311-lxml_html_clean-0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-10T00:00:00Z","modified":"2026-03-23T04:54:40.555864Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20345-1","title":"Security update for python-lxml_html_clean","description":"This update for python-lxml_html_clean fixes the following issues:\n\nChanges in python-lxml_html_clean:\n\n- CVE-2026-28348: improper keywords checking can allow external CSS loading (bsc#1259378)\n- CVE-2026-28350: lack of base tag handling can allow the hijacking of the resolution of relative URLs (bsc#1259379)\n","status":"published","published":"2026-03-11T18:05:18Z","modified":"2026-03-13T08:57:17.552522Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}