Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for <base>, allowing an attacker to inject it and hijack relative links on the page. This issue has been patched in version 0.4.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-05 | 1 | Disclosure1 |
| 2026-03-06 | 1 | General1 |
| 2026-03-10 | 1 | Disclosure1 |
🟠 lxml_html_clean, URL Hijacking, #CVE-2026-28350 (Medium) https://dailycve.com/lxml_html_clean-url-hijacking-cve-2026-28350-medium/
Post summary
The post announces CVE‑2026‑28350 as a Medium‑sourced URL hijacking flaw in lxml_html_clean, with no further exploit, patch, or mitigation details.
CVE-2026-28350 Base Tag Injection Vulnerability in lxml_html_clean Before Versio... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28350 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
A brief alert referencing CVE‑2026‑28350, indicating a base tag injection issue in lxml_html_clean, but providing no technical depth or evidence of exploitation or remediation.
CVE-2026-28350 lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default Cleane… https://www.cve.org/CVERecord?id=CVE-2026-28350
Post summary
The CVE entry indicates that lxml_html_clean versions before 0.4.4 allow the <base> tag to pass through the cleaner, implying a potential vulnerability, but no exploit details or fixes are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fedoralovespython | lxml_html_clean | - | python | - |