Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

chore(deps): bump lxml-html-clean from 0.4.3 to 0.4.4

Closed
Number: #457
Type: Pull Request
State: Closed
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 2
Created: March 03, 2026 at 01:39 PM UTC
(3 months ago)
Updated: March 05, 2026 at 08:20 AM UTC
(3 months ago)
Closed: March 05, 2026 at 08:20 AM UTC
(3 months ago)
Time to Close: 2 days
Labels:
dependencies python:uv
Description:

Bumps lxml-html-clean from 0.4.3 to 0.4.4.

Changelog

Sourced from lxml-html-clean's changelog.

0.4.4 (2026-02-26)

Bugs fixed

  • Fixed a bug where Unicode escapes in CSS were not properly decoded before security checks. This prevents attackers from bypassing filters using escape sequences. (CVE-2026-28348)
  • Fixed a security issue where <base> tags could be used for URL hijacking attacks. The <base> tag is now automatically removed whenever the <head> tag is removed (via page_structure=True or manual configuration), as <base> must be inside <head> according to HTML specifications. (CVE-2026-28350)
Commits
  • fd10d79 Add more tests for different combinations of backslashes and unicode
  • 5b7e228 Restore the removal of all backslashes from styles after decoding of unicode ...
  • 88da8f9 Prepare release 0.4.4
  • 9c5612c Remove <base> tags to prevent URL hijacking attacks
  • 2ef7326 Implement unicode escape decoding
  • 7c854af Add missing Python 3.14 to classifiers
  • 80cebf7 Continue using the package link
  • 1cef82e Update safe sanitizer recommendation
  • 79f35f4 CI: Drop Python 3.8, add 3.14
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.
Package Dependencies
Package:
lxml-html-clean
Ecosystem:
pip
Version Change:
0.4.3 → 0.4.4
Update Type:
Patch
Security Advisories
lxml-html-clean has <base> tag injection through default Cleaner configuration
GHSA-xvp8-3mhv-424c CVE-2026-28350 MODERATE
### Summary The `<base>` tag passes through the default `Cleaner` configuration. While `page_structure=True` removes `html`, `head`, and `title` tags, there is no specific handling for `<base>`, al...
lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes
GHSA-hw26-mmpg-fqfg CVE-2026-28348 MODERATE
### Summary The `_has_sneaky_javascript()` method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the `@import` and `expression()` ...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 14397927
UUID: 4016728979
Node ID: PR_kwDOOMEdyc7HnFmt
Host: GitHub
Repository: aignostics/python-sdk