CVE-2026-28348

lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javascript() method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression() filters, allowing external CSS loading or XSS in older browsers. This issue has been patched in version 0.4.4.

• CWE-116

• https://github.com/fedora-python/lxml_html_clean/commit/2ef732667ddbc74ea59847bcf24b75809aaeed3bPatch
• https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-hw26-mmpg-fqfgExploit, Vendor Advisory
• https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-hw26-mmpg-fqfgExploit, Vendor Advisory

Published

Mar 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28323SolarWinds Web Help Desk is found to be affected by a SAML a…9.8
• CVE-2026-2833An HTTP request smuggling vulnerability (CWE-444) was found …9.1
• CVE-2026-28338PMD is an extensible multilanguage static code analyzer. Pri…6.1
• CVE-2026-2834The Age Verification & Identity Verification by Token of Tru…7.2
• CVE-2026-28342OliveTin gives access to predefined shell commands from a we…7.5
• CVE-2026-28343CKEditor 5 is a modern JavaScript rich-text editor with an M…6.1
• CVE-2026-2835An HTTP Request Smuggling vulnerability (CWE-444) has been f…9.1
• CVE-2026-28350lxml_html_clean is a project for HTML cleaning functionaliti…6.1
• CVE-2026-28351pypdf is a free and open-source pure-python PDF library. Pri…5.3
• CVE-2026-28352Indico is an event management system that uses Flask-Multipa…6.5
• CVE-2026-28353Trivy Vulnerability Scanner is a VS Code extension that help…10
• CVE-2026-28354ClipBucket v5 is an open source video sharing platform. Prio…6.5