CVE-2021-43818: HTML Cleaner allows crafted and SVG embedded scripts to pass through

Modified

AliasesALPINE-CVE-2021-43818MGASA-2021-0595GHSA-55x5-fj6c-h6m8+9 more

Published 13-12-2021Last modified 18-12-2025

Vulnerability summary

CVE-2021-43818 is a high (CVSS 8.2) vulnerability in debian debian_linux. EPSS estimates a 2.66% chance of exploitation in the next 30 days, higher than 85.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.2, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.2/10

010

High · v3.1 (CVE.org)

EPSS score

2.66%

0%100%

Low · +0.19 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 4

OPENSUSE-SU-2022:0803-1 RHSA-2022:1764 RHSA-2022:1821 RHSA-2022:5498 SUSE-SU-2022:0803-1 SUSE-SU-2022:0895-1+1 more

Timeline

13-12-2021
PublishedVulnerability first disclosed.
18-12-2025
Last modifiedVulnerability information updated.

Description

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

CVSS metrics

9 scores · 7 sources · 3 versions

v4.06.3v3.18.2v2.06.8

EPSS trend

Probability

2.66%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

Increase +0.19 pp

From 2.48% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat80 products

mod_wsgi< 0:4.7.1-4.module+el8.4.0+9822+20bf1249
numpy< 0:1.19.4-3.module+el8.5.0+12204+54860423
numpy-debugsource< 0:1.19.4-3.module+el8.5.0+12204+54860423
python-cffi< 0:1.14.3-2.module+el8.4.0+9822+20bf1249
python-cffi-debugsource< 0:1.14.3-2.module+el8.4.0+9822+20bf1249

python-chardet< 0:3.0.4-19.module+el8.4.0+9822+20bf1249
python-cryptography< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python-cryptography-debugsource< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python-idna< 0:2.10-3.module+el8.4.0+9822+20bf1249
python-lxml< 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c | < 0:4.2.3-4.el8
python-lxml-debugsource< 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c | < 0:4.2.3-4.el8
python-ply< 0:3.11-10.module+el8.4.0+9822+20bf1249
python-psutil< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python-psutil-debugsource< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python-psycopg2< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python-psycopg2-debugsource< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python-pycparser< 0:2.20-3.module+el8.4.0+9822+20bf1249
python-PyMySQL< 0:0.10.1-2.module+el8.4.0+9822+20bf1249
python-pysocks< 0:1.7.1-4.module+el8.4.0+9822+20bf1249
python-requests< 0:2.25.0-2.module+el8.4.0+9822+20bf1249
python-toml< 0:0.10.1-5.module+el8.4.0+9822+20bf1249
python-urllib3< 0:1.25.10-4.module+el8.5.0+11712+ea2d2be1
python-wheel< 1:0.35.1-4.module+el8.5.0+12204+54860423
python3-lxml< 0:4.2.3-4.el8
python3-lxml-debuginfo< 0:4.2.3-4.el8
python39< 0:3.9.7-1.module+el8.6.0+12577+62b8d0a1
python39-cffi< 0:1.14.3-2.module+el8.4.0+9822+20bf1249
python39-cffi-debuginfo< 0:1.14.3-2.module+el8.4.0+9822+20bf1249
python39-chardet< 0:3.0.4-19.module+el8.4.0+9822+20bf1249
python39-cryptography< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python39-cryptography-debuginfo< 0:3.3.1-2.module+el8.4.0+9822+20bf1249
python39-debuginfo< 0:3.9.7-1.module+el8.6.0+12577+62b8d0a1
python39-debugsource< 0:3.9.7-1.module+el8.6.0+12577+62b8d0a1
python39-devel< 0:3.9.7-1.module+el8.6.0+12577+62b8d0a1
python39-idle< 0:3.9.7-1.module+el8.6.0+12577+62b8d0a1
python39-idna< 0:2.10-3.module+el8.4.0+9822+20bf1249
python39-libs< 0:3.9.7-1.module+el8.6.0+12577+62b8d0a1
python39-lxml< 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c
python39-lxml-debuginfo< 0:4.6.5-1.module+el8.6.0+13933+9cf0c87c
python39-mod_wsgi< 0:4.7.1-4.module+el8.4.0+9822+20bf1249
python39-numpy< 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-numpy-debuginfo< 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-numpy-doc< 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-numpy-f2py< 0:1.19.4-3.module+el8.5.0+12204+54860423
python39-pip< 0:20.2.4-7.module+el8.6.0+13003+6bb2c488
python39-pip-wheel< 0:20.2.4-7.module+el8.6.0+13003+6bb2c488
python39-ply< 0:3.11-10.module+el8.4.0+9822+20bf1249
python39-psutil< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python39-psutil-debuginfo< 0:5.8.0-4.module+el8.4.0+9822+20bf1249
python39-psycopg2< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-psycopg2-debuginfo< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-psycopg2-doc< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-psycopg2-tests< 0:2.8.6-2.module+el8.4.0+9822+20bf1249
python39-pycparser< 0:2.20-3.module+el8.4.0+9822+20bf1249
python39-PyMySQL< 0:0.10.1-2.module+el8.4.0+9822+20bf1249
python39-pysocks< 0:1.7.1-4.module+el8.4.0+9822+20bf1249
python39-pyyaml< 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
python39-pyyaml-debuginfo< 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
python39-requests< 0:2.25.0-2.module+el8.4.0+9822+20bf1249
python39-rpm-macros< 0:3.9.7-1.module+el8.6.0+12577+62b8d0a1
python39-scipy< 0:1.5.4-3.module+el8.4.0+9822+20bf1249
python39-scipy-debuginfo< 0:1.5.4-3.module+el8.4.0+9822+20bf1249
python39-setuptools< 0:50.3.2-4.module+el8.5.0+12204+54860423
python39-setuptools-wheel< 0:50.3.2-4.module+el8.5.0+12204+54860423
python39-six< 0:1.15.0-3.module+el8.4.0+9822+20bf1249
python39-test< 0:3.9.7-1.module+el8.6.0+12577+62b8d0a1
python39-tkinter< 0:3.9.7-1.module+el8.6.0+12577+62b8d0a1
python39-toml< 0:0.10.1-5.module+el8.4.0+9822+20bf1249
python39-urllib3< 0:1.25.10-4.module+el8.5.0+11712+ea2d2be1
python39-wheel< 1:0.35.1-4.module+el8.5.0+12204+54860423
python39-wheel-wheel< 1:0.35.1-4.module+el8.5.0+12204+54860423
python3x-pip< 0:20.2.4-7.module+el8.6.0+13003+6bb2c488
python3x-setuptools< 0:50.3.2-4.module+el8.5.0+12204+54860423
python3x-six< 0:1.15.0-3.module+el8.4.0+9822+20bf1249
PyYAML< 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
PyYAML-debugsource< 0:5.4.1-1.module+el8.5.0+10613+59a13ec4
rh-python38-python-lxml< 0:4.4.1-8.el7
rh-python38-python-lxml-debuginfo< 0:4.4.1-8.el7
scipy< 0:1.5.4-3.module+el8.4.0+9822+20bf1249
scipy-debugsource< 0:1.5.4-3.module+el8.4.0+9822+20bf1249

Show all 80

Oracle5 products

communications_cloud_native_core_binding_support_function22.1.3
communications_cloud_native_core_network_exposure_function22.1.1
communications_cloud_native_core_policy22.2.0
http_server12.2.1.3.0 | 12.2.1.4.0
zfs_storage_appliance_kit8.8

Netapp3 products

Debian2 products

lxml< 4.3.2-1+deb10u4 | < 4.6.3+dfsg-0.1+deb11u1 | < 3.7.1-1+deb9u5 | < 4.7.1-1
debian_linuxEOL9.0 | 10.0 | 11.0

Alpine1 product

py3-lxml< 4.6.5-r0

Fedoraproject1 product

fedoraEOL34 | 35

Lxml1 product

lxml< 4.6.5

Mageia1 product

python-lxml< 4.6.5-1.mga8

PyPI1 product

lxml< 12fa9669007180a7bb87d990c375cf91ca5b664a | < a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c | < 4.6.5

Ubuntu1 product

lxml< 4.7.1-1 | < 3.3.3-1ubuntu0.2+esm5 | < 3.5.0-1ubuntu0.4+esm2 | < 4.2.1-1ubuntu0.6 | < 4.5.0-1ubuntu0.5

10 vendors · 96 products

References

45 links

github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8X Refsource CONFIRMWEBAdvisoryREPORTThird Party Advisory
github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664aX Refsource MISCWEBFIXREPORTPatchThird Party Advisory
github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9cX Refsource MISCWEBFIXREPORTPatchThird Party Advisory
github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0X Refsource MISCWEBFIXREPORTPatchThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.debian.org/debian-lts-announce/2021/12/msg00037.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
www.debian.org/security/2022/dsa-5043Vendor AdvisoryX Refsource DEBIANWEBThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA

Show all 45 references

www.oracle.com/security-alerts/cpuapr2022.htmlX Refsource MISCWEBPatchThird Party Advisory
security.netapp.com/advisory/ntap-20220107-0005/X Refsource CONFIRMThird Party Advisory
www.oracle.com/security-alerts/cpujul2022.htmlX Refsource MISCWEBPatchThird Party Advisory
security.gentoo.org/glsa/202208-06Vendor AdvisoryX Refsource GENTOOWEBThird Party Advisory
security.alpinelinux.org/vuln/CVE-2021-43818Advisory
advisories.mageia.org/MGASA-2021-0595.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=29817REPORT
lists.fedoraproject.org/archives/…WEB
nvd.nist.gov/vuln/detail/CVE-2021-43818AdvisoryOval
security.netapp.com/advisory/ntap-20220107-0005WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-852.yamlWEB
github.com/lxml/lxmlPACKAGE
access.redhat.com/errata/RHSA-2022:1664Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2032569REPORT
bugzilla.redhat.com/show_bug.cgi?id=2064443REPORT
bugzilla.redhat.com/show_bug.cgi?id=2068592REPORT
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1664.jsonAdvisory
access.redhat.com/security/cve/CVE-2021-43818REPORT
www.cve.org/CVERecord?id=CVE-2021-43818AdvisoryREPORT
github.com/lxml/lxml/blob/lxml-4.6.5/CHANGES.txtARTICLE
access.redhat.com/errata/RHSA-2022:1763Advisory
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2003102REPORT
bugzilla.redhat.com/show_bug.cgi?id=2006790REPORT
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1763.jsonAdvisory
access.redhat.com/errata/RHSA-2022:1932Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1932.jsonAdvisory
ubuntu.com/security/CVE-2021-43818REPORT
ubuntu.com/security/notices/USN-5225-1Advisory
security-tracker.debian.org/tracker/CVE-2021-43818Advisory