PatchTheCVEhtml5lib vulnerabilities and fixes
Recent CVEs affecting html5lib, with upgrade or downgrade steps. 2 tracked.
html5lib has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2017-02-22. Highest priority: CVE-2016-9910 (score 42/100).
- CVE-2016-9910 MEDIUM 6.1 UPGRADE The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS
- CVE-2016-9909 MEDIUM 6.1 UPGRADE The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS
FAQ
How do I fix html5lib vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is html5lib being exploited right now?
None of the tracked html5lib CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which html5lib CVE should I patch first?
CVE-2016-9910 currently ranks highest (42/100): The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS.