CVE-2014-3146: Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attacke...

Security readout for executives and security teams

CVE-2014-3146 is an XSS flaw in Python lxml's HTML cleaner before 3.3.5. If an application relied on clean_html to sanitize user-supplied HTML, crafted links using control characters could bypass filtering and run script in a victim's browser. Business risk is mainly session theft, content tampering, or phishing inside affected web apps. Exposure is limited to applications using lxml before 3.3.5 and relying on lxml.html.clean.clean_html for untrusted HTML. The CVE metadata does not provide CPEs, so teams must confirm by dependency inventory and code review rather than product matching alone. Treat as a moderate-priority remediation for internet-facing or multi-user web applications that process user HTML. It is old and not KEV-listed in the provided data, but sanitizer flaws can become business-impacting when embedded in content workflows. Mitigation focus: Upgrade lxml to version 3.3.5 or a later fixed release.; Apply Debian, Ubuntu, Mageia, openSUSE, Mandriva, or other distro security updates where applicable.; Identify applications that sanitize user-supplied HTML with lxml.html.clean.clean_html..

Prepared

May 25, 2026, 04:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.