https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T23:00:49.207875+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-28350 CVE-2026-28350 — lxml_html_clean: <base> tag injection through default Cleaner configuration 2026-09-29T23:00:50.220228+00:00

Affected: fedora-python lxml_html_clean

lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for <base>, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.