---
title: "CX-2020-4286"
date: "2020-11-27T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4286/"
---

# CX-2020-4286

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Nov 27, 2020

CVE-2020-27783  **Published:** Nov 27, 2020

CWE-79 CWE-79  6.1 Medium Severity mxss python XSS

YN Yaniv Nizry  Reported by Checkmarx Zero

Details Overview

## Summary

The lxml python package is vulnerable to mXSS due to the use of improper parser. The parser used doesn’t imitate browsers, which causes different behaviors between the sanitizer and the user’s page. This can result in an arbitrary HTML/JS code execution.

## Product

lxml from 1.2 up to 4.6.1

## Impact

Using lxml as a sanitizer might not fulfill its purpose.

## Steps to reproduce

```
>>> from lxml.html.clean import clean_html
>>> clean_html('<svg><style><img src=x onerror=alert(1)></style></svg>')
>>> clean_html('<noscript><style><a title="</noscript><img src=x onerror=alert(1)>">')
```

### Expected result:

`<svg><style><img src=x onerror=alert(1)></style></svg>`  
And  
`<noscript><style><a title="</noscript><img src=x onerror=alert(1)>"></style></noscript>`

## Remediation

Update lxml dependency to 4.6.2 or above.

## Credit

This issue was discovered and reported by Checkmarx SCA Security Researcher [Yaniv Nizry](https://twitter.com/ynizry).

## Resources

1. [Advisory](https://github.com/advisories/GHSA-pgww-xf46-h92r)
2. [89e7aad](https://github.com/lxml/lxml/commit/89e7aad6e7ff9ecd88678ff25f885988b1)
3. [a105ab8](https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7)

0  Medium Severity CVSS v3.1 Score

   6.1

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

Advisory Timeline1. Discovered Sep 16, 2020 Notified the maintainer
2. Fixed Nov 27, 2020 Final fix got pushed and 4.6.2 got released

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)