CVE-2021-28957: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-03-21T05:15Z
Repository: https://github.com/lxml/lxml
Language: Other
Files changed: CHANGES.txt, doc/main.txt, src/lxml/__init__.py
Commit date: 2021-03-21 15:11:30 +0100
Commit message: Prepare release of lxml 4.6.3.

Diff: diff --git a/CHANGES.txt b/CHANGES.txt
index e3b77140..22f4d450 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,9 +1,20 @@
 ==============
 lxml changelog
 ==============
 
+4.6.3 (2021-03-21)
+==================
+
+Bugs fixed
+----------
+
+* A vulnerability (CVE-2021-28957) was discovered in the HTML Cleaner by Kevin Chung,
+  which allowed JavaScript to pass through.  The cleaner now removes the HTML5
+  ``formaction`` attribute.
+
+
 4.6.2 (2020-11-26)
 ==================
 
 Bugs fixed
 ----------
diff --git a/doc/main.txt b/doc/main.txt
index d42c66a3..ead457d6 100644
--- a/doc/main.txt
+++ b/doc/main.txt
@@ -157,12 +157,12 @@ Download
 The best way to download lxml is to visit `lxml at the Python Package
 Index <http://pypi.python.org/pypi/lxml/>`_ (PyPI).  It has the source
 that compiles on various platforms.  The source distribution is signed
 with `this key <pubkey.asc>`_.
 
-The latest version is `lxml 4.6.2`_, released 2020-11-26
-(`changes for 4.6.2`_).  `Older versions <#old-versions>`_
+The latest version is `lxml 4.6.3`_, released 2021-03-21
+(`changes for 4.6.3`_).  `Older versions <#old-versions>`_
 are listed below.
 
 Please take a look at the
 `installation instructions <installation.html>`_ !
 
@@ -254,11 +254,13 @@ See the websites of lxml
 `1.3 <http://lxml.de/1.3/>`_
 
 ..
    and the `latest in-development version <http://lxml.de/dev/>`_.
 
-.. _`PDF documentation`: lxmldoc-4.6.2.pdf
+.. _`PDF documentation`: lxmldoc-4.6.3.pdf
+
+* `lxml 4.6.3`_, released 2021-03-21 (`changes for 4.6.3`_)
 
 * `lxml 4.6.2`_, released 2020-11-26 (`changes for 4.6.2`_)
 
 * `lxml 4.6.1`_, released 2020-10-18 (`changes for 4.6.1`_)
 
@@ -278,10 +280,11 @@ See the websites of lxml
 
 * `lxml 4.4.0`_, released 2019-07-27 (`changes for 4.4.0`_)
 
 * `older releases <http://lxml.de/4.3/#old-versions>`_
 
+.. _`lxml 4.6.3`: /files/lxml-4.6.3.tgz
 .. _`lxml 4.6.2`: /files/lxml-4.6.2.tgz
 .. _`lxml 4.6.1`: /files/lxml-4.6.1.tgz
 .. _`lxml 4.6.0`: /files/lxml-4.6.0.tgz
 .. _`lxml 4.5.2`: /files/lxml-4.5.2.tgz
 .. _`lxml 4.5.1`: /files/lxml-4.5.1.tgz
@@ -289,10 +292,11 @@ See the websites of lxml
 .. _`lxml 4.4.3`: /files/lxml-4.4.3.tgz
 .. _`lxml 4.4.2`: /files/lxml-4.4.2.tgz
 .. _`lxml 4.4.1`: /files/lxml-4.4.1.tgz
 .. _`lxml 4.4.0`: /files/lxml-4.4.0.tgz
 
+.. _`changes for 4.6.3`: /changes-4.6.3.html
 .. _`changes for 4.6.2`: /changes-4.6.2.html
 .. _`changes for 4.6.1`: /changes-4.6.1.html
 .. _`changes for 4.6.0`: /changes-4.6.0.html
 .. _`changes for 4.5.2`: /changes-4.5.2.html
 .. _`changes for 4.5.1`: /changes-4.5.1.html
diff --git a/src/lxml/__init__.py b/src/lxml/__init__.py
index ed50c4bb..c569544b 100644
--- a/src/lxml/__init__.py
+++ b/src/lxml/__init__.py
@@ -1,8 +1,8 @@
 # this is a package
 
-__version__ = "4.6.2"
+__version__ = "4.6.3"
 
 
 def get_include():
     """
     Returns a list of header include paths (for lxml itself, libxml2

Vulnerable code: The latest version is `lxml 4.6.2`_, released 2020-11-26
(`changes for 4.6.2`_).  `Older versions <#old-versions>`_
.. _`PDF documentation`: lxmldoc-4.6.2.pdf
__version__ = "4.6.2"
Fixed code: 4.6.3 (2021-03-21)
==================

Bugs fixed
----------

* A vulnerability (CVE-2021-28957) was discovered in the HTML Cleaner by Kevin Chung,
  which allowed JavaScript to pass through.  The cleaner now removes the HTML5
  ``formaction`` attribute.


The latest version is `lxml 4.6.3`_, released 2021-03-21
(`changes for 4.6.3`_).  `Older versions <#old-versions>`_
.. _`PDF documentation`: lxmldoc-4.6.3.pdf

* `lxml 4.6.3`_, released 2021-03-21 (`changes for 4.6.3`_)
.. _`lxml 4.6.3`: /files/lxml-4.6.3.tgz
.. _`changes for 4.6.3`: /changes-4.6.3.html
__version__ = "4.6.3"