{
  "cveId": "CVE-2024-52595",
  "url": "https://patchblox.com/security/cve/CVE-2024-52595",
  "summary": "CVE-2024-52595 is fixed in lxml-html-clean on 1 platform, first by DEBIAN-CVE-2024-52595, released November 19, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "lxml-html-clean: lxml_html_clean is a project for HTML cleaning functionalities copied from \u0060lxml.html.clean\u0060",
  "description": "lxml_html_clean is a project for HTML cleaning functionalities copied from \u0060lxml.html.clean\u0060. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as \u0060\u003Csvg\u003E\u0060, \u0060\u003Cmath\u003E\u0060 and \u0060\u003Cnoscript\u003E\u0060. This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying on lxml_html_clean in default configuration for sanitizing untrusted HTML content. Users employing the HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue. As a temporary mitigation, users can configure lxml_html_clean with the following settings to prevent the exploitation of this vulnerability. Via \u0060remove_tags\u0060, one may specify tags to remove - their content is moved to their parents\u0027 tags. Via \u0060kill_tags\u0060, one may specify tags to be removed completely. Via \u0060allow_tags\u0060, one may restrict the set of permissible tags, excluding context-switching tags like \u0060\u003Csvg\u003E\u0060, \u0060\u003Cmath\u003E\u0060 and \u0060\u003Cnoscript\u003E\u0060.",
  "published": "2024-11-19T22:15:21Z",
  "severity": "medium",
  "cvss": 6.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.00508,
  "epssPercentile": 0.43648,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "lxml-html-clean",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.4.1-1",
      "fix": "DEBIAN-CVE-2024-52595",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-52595",
      "released": "2024-11-19T22:15:21Z"
    },
    {
      "platform": "linux",
      "product": "lxml-html-clean",
      "release": "Debian 14",
      "fixedVersion": "0.4.1-1",
      "fix": "DEBIAN-CVE-2024-52595",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-52595",
      "released": "2024-11-19T22:15:21Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}