CVE-2026-28350
Medium
Description
lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for <base>, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.
SeverityMedium
CVSS6.1
Exploit probability—
ProductFedoralovespython Lxml Html Clean
PublishedMar 5, 2026
First seenMar 5, 2026
Weakness typeCWE-116CWE-116
How to fix
Update
- fedoralovespython lxml_html_clean0.4.4 or later
- lxml-html-clean0.4.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fedoralovespython lxml_html_clean | v < 0.4.4 | 0.4.4 |
| lxml-html-cleanPyPI | v < 0.4.4 | 0.4.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.