CVE-2021-43818: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 7.1
Published: 2021-12-13T18:15Z
Repository: https://github.com/lxml/lxml
Language: Other
Files changed: CHANGES.txt, doc/main.txt, src/lxml/__init__.py
Commit date: 2021-12-12 15:10:58 +0100
Commit message: Prepare release of 4.6.5.

Diff: diff --git a/CHANGES.txt b/CHANGES.txt
index 8314e6e91..2a0e1e22e 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,10 +1,10 @@
 ==============
 lxml changelog
 ==============
 
-4.6.5 (2021-12-??)
+4.6.5 (2021-12-12)
 ==================
 
 Bugs fixed
 ----------
 
diff --git a/doc/main.txt b/doc/main.txt
index 75fedd5ec..55e32d545 100644
--- a/doc/main.txt
+++ b/doc/main.txt
@@ -157,12 +157,12 @@ Download
 The best way to download lxml is to visit `lxml at the Python Package
 Index <http://pypi.python.org/pypi/lxml/>`_ (PyPI).  It has the source
 that compiles on various platforms.  The source distribution is signed
 with `this key <pubkey.asc>`_.
 
-The latest version is `lxml 4.6.4`_, released 2021-11-01
-(`changes for 4.6.4`_).  `Older versions <#old-versions>`_
+The latest version is `lxml 4.6.5`_, released 2021-12-12
+(`changes for 4.6.5`_).  `Older versions <#old-versions>`_
 are listed below.
 
 Please take a look at the
 `installation instructions <installation.html>`_ !
 
@@ -254,11 +254,13 @@ See the websites of lxml
 `1.3 <http://lxml.de/1.3/>`_
 
 ..
    and the `latest in-development version <http://lxml.de/dev/>`_.
 
-.. _`PDF documentation`: lxmldoc-4.6.4.pdf
+.. _`PDF documentation`: lxmldoc-4.6.5.pdf
+
+* `lxml 4.6.5`_, released 2021-12-12 (`changes for 4.6.5`_)
 
 * `lxml 4.6.4`_, released 2021-11-01 (`changes for 4.6.4`_)
 
 * `lxml 4.6.3`_, released 2021-03-21 (`changes for 4.6.3`_)
 
@@ -282,10 +284,11 @@ See the websites of lxml
 
 * `lxml 4.4.0`_, released 2019-07-27 (`changes for 4.4.0`_)
 
 * `older releases <http://lxml.de/4.3/#old-versions>`_
 
+.. _`lxml 4.6.5`: /files/lxml-4.6.5.tgz
 .. _`lxml 4.6.4`: /files/lxml-4.6.4.tgz
 .. _`lxml 4.6.3`: /files/lxml-4.6.3.tgz
 .. _`lxml 4.6.2`: /files/lxml-4.6.2.tgz
 .. _`lxml 4.6.1`: /files/lxml-4.6.1.tgz
 .. _`lxml 4.6.0`: /files/lxml-4.6.0.tgz
@@ -295,10 +298,11 @@ See the websites of lxml
 .. _`lxml 4.4.3`: /files/lxml-4.4.3.tgz
 .. _`lxml 4.4.2`: /files/lxml-4.4.2.tgz
 .. _`lxml 4.4.1`: /files/lxml-4.4.1.tgz
 .. _`lxml 4.4.0`: /files/lxml-4.4.0.tgz
 
+.. _`changes for 4.6.5`: /changes-4.6.5.html
 .. _`changes for 4.6.4`: /changes-4.6.4.html
 .. _`changes for 4.6.3`: /changes-4.6.3.html
 .. _`changes for 4.6.2`: /changes-4.6.2.html
 .. _`changes for 4.6.1`: /changes-4.6.1.html
 .. _`changes for 4.6.0`: /changes-4.6.0.html
diff --git a/src/lxml/__init__.py b/src/lxml/__init__.py
index 6670d16bb..eb968d5cc 100644
--- a/src/lxml/__init__.py
+++ b/src/lxml/__init__.py
@@ -1,8 +1,8 @@
 # this is a package
 
-__version__ = "4.6.4"
+__version__ = "4.6.5"
 
 
 def get_include():
     """
     Returns a list of header include paths (for lxml itself, libxml2

Vulnerable code: 4.6.5 (2021-12-??)
The latest version is `lxml 4.6.4`_, released 2021-11-01
(`changes for 4.6.4`_).  `Older versions <#old-versions>`_
.. _`PDF documentation`: lxmldoc-4.6.4.pdf
__version__ = "4.6.4"
Fixed code: 4.6.5 (2021-12-12)
The latest version is `lxml 4.6.5`_, released 2021-12-12
(`changes for 4.6.5`_).  `Older versions <#old-versions>`_
.. _`PDF documentation`: lxmldoc-4.6.5.pdf

* `lxml 4.6.5`_, released 2021-12-12 (`changes for 4.6.5`_)
.. _`lxml 4.6.5`: /files/lxml-4.6.5.tgz
.. _`changes for 4.6.5`: /changes-4.6.5.html
__version__ = "4.6.5"