CVE-2020-27783 (Medium) detected in lxml-4.5.0-cp36-cp36m-manylinux1_x86_64.whl

## CVE-2020-27783 - Medium Severity Vulnerability
Vulnerable Library - lxml-4.5.0-cp36-cp36m-manylinux1_x86_64.whl

Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.

Library home page: https://files.pythonhosted.org/packages/dd/ba/a0e6866057fc0bbd17192925c1d63a3b85cf522965de9bc02364d08e5b84/lxml-4.5.0-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: /server/requirements.txt

Path to vulnerable library: /server/requirements.txt

Dependency Hierarchy:
- :x: **lxml-4.5.0-cp36-cp36m-manylinux1_x86_64.whl** (Vulnerable Library)

Found in base branch: dev

Vulnerability Details

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

Publish Date: 2020-12-03

URL: CVE-2020-27783

CVSS 3 Score Details (6.1)

Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1901633

Release Date: 2020-12-03

Fix Resolution: 4.6.1

***
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)

Review /server/requirements.txt, where lxml 4.5.0 is listed as the vulnerable dependency. Upgrade lxml to the stated fixed version, 4.6.1, then verify that the dependency no longer reports CVE-2020-27783.

Written by the indexing model from the issue text.