CVE-2026-28348 - lxml_html_clean: CSS @import Filter Bypass via Unicode Escapes

CVE ID : CVE-2026-28348 Published : March 5, 2026, 8:16 p.m. | 1 hour, 27 minutes ago Description : lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javascript() method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression() filters, allowing external CSS loading or XSS in older browsers. This issue has been patched in version 0.4.4. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...