Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-19787

22
FAUCET Score

CVE-2018-19787 describes a cross-site scripting (XSS) vulnerability in lxml versions prior to 4.2.5, specifically within the lxml.html.clean module. This flaw allows attackers to bypass JavaScript URL sanitization by using escaping techniques, enabling XSS attacks, particularly in browsers like Internet Explorer. Rated as MEDIUM severity (CVSS 6.1), it requires user interaction and can lead to limited confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 4.2.5CPE matchmatch criteria
cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
12.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
14.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
16.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

CVSS Data

CVSS version used by this source: 3.0

6.1MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
2.7
CvssVersion
3.0

Exploit Intelligence

EPSS Score
2.44%
Probability of exploitation in next 30 days
EPSS Percentile
82.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.0244 is in the 92nd percentile among its peer group of 26,209 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (21)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: 16956-16820Fixed in: 4.6.3-1
microsoftpatch availablevia msrc
Product: 16957-16823Fixed in: 4.8.0-1
microsoftpatch availablevia msrc
Product: cm1 python-lxml 4.6.3-1 on CBL Mariner 1.0Fixed in: 4.6.3-1
microsoftpatch availablevia msrc
Product: cbl2 python-lxml 4.8.0-1 on CBL Mariner 2.0Fixed in: 4.8.0-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 4.8.0-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 4.8.0-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 4.6.3-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 4.6.3-1
pippatch availablevia ghsa
Product: lxmlFixed in: 4.2.5
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 14 (Rocky)Fixed in: python-lxml
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 10 (Newton)Fixed in: python-lxml
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 12 (Pike)Fixed in: python-lxml
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 13 (Queens)Fixed in: python-lxml
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 8 (Liberty)Fixed in: python-lxml
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 9 (Mitaka)Fixed in: python-lxml
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: python-lxml
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: python-lxml
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: python-lxml
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)Fixed in: python-lxml
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: python-lxml

Vendor Advisories (4)

pipGHSA-xp26-p53h-6h2pmedium

Improper Neutralization of Input During Web Page Generation in LXML

May 13, 2022
microsoft2021-Jul/CVE-2018-19787

CVE-2018-19787

Jul 13, 2021
microsoft2018-Dec/CVE-2018-19787Moderate

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping allowing a remote attacker to conduct XSS attacks as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

Dec 11, 2018
redhatCVE-2018-19787Moderate

python-lxml: XSS in lxml.html.clean module in lxml/html/clean.py

Sep 9, 2018

References

github.com / lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109
PatchVendor Advisory
lists.debian.org / debian-lts-announce/2018/12/msg00001.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2020/11/msg00044.html
usn.ubuntu.com / 3841-1
Third Party Advisory
usn.ubuntu.com / 3841-2
Third Party Advisory