- Fix bsc#1179534 (CVE-2020-27783)
mXSS due to the use of improper parser
Patch files: 0001-CVE-2020-27783.patch 0002-CVE-2020-27783.patch
- Fix bsc#1118088 (CVE-2018-19787)
lxml/html/clean.py in the lxml.html.clean module does not remove
javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks
Patch file: 0001-CVE-2018-19787.patch
- Fix bsc#1184177 (CVE-2021-28957)
missing input sanitization for formaction HTML5 attributes may lead to XSS
Patch file: 0001-CVE-2021-28957.patch
- Fix bsc#1193752 (CVE-2021-43818)
Cleaner: Remove SVG image data URLs since they can embed script content.
Reported as GHSL-2021-1037 and GHSL-2021-1038
Patch files 0001-CVE-2021-43818.patch 0002-CVE-2021-43818.patch