CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

• CWE-79
• CWE-79

• https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/12/msg00001.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/11/msg00044.html
• https://usn.ubuntu.com/3841-1/Third Party Advisory
• https://usn.ubuntu.com/3841-2/Third Party Advisory
• https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/12/msg00001.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/11/msg00044.html
• https://usn.ubuntu.com/3841-1/Third Party Advisory
• https://usn.ubuntu.com/3841-2/Third Party Advisory

Published

Dec 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1978IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Se…8.4
• CVE-2018-19782Multiple cross-site scripting (XSS) vulnerabilities in GET r…
• CVE-2018-19783Kentix MultiSensor-LAN 5.63.00 devices and previous allow Au…
• CVE-2018-19784The str_rot_pass function in vendor/atholn1600/php-proxy/src…
• CVE-2018-19785PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via t…
• CVE-2018-19786HashiCorp Vault before 1.0.0 writes the master key to the se…
• CVE-2018-19788A flaw was found in PolicyKit (aka polkit) 0.115 that allows…
• CVE-2018-19789An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.…
• CVE-2018-19790An open redirect was discovered in Symfony 2.7.x before 2.7.…
• CVE-2018-19791The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does …
• CVE-2018-19792The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allow…
• CVE-2018-19793jiacrontab 1.4.5 allows remote attackers to execute arbitrar…