The lxml_html_clean library contained a flaw in its _has_sneaky_javascript() method that removed backslashes before checking for dangerous CSS keywords. This allowed CSS Unicode escape sequences to bypass the @import and expression() filters, meaning an attacker could load external CSS or trigger legacy XSS victims in older browsers.

Fedora‑Python lxml_html_clean versions prior to 0.4.4 are affected; the vulnerability is present in the library bundled with older Fedora releases or in projects that depend on the unpatched library.

The CVSS score of 6.1 indicates moderate severity while the EPSS score of less than 1% shows the likelihood of exploitation is low at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply crafted HTML content that is processed by a web application using the vulnerable library, and the exploit typically succeeds only in legacy browsers that honor the @import directive and CSS expression() feature. Because it leads to cross‑site scripting, it poses a confidentiality and integrity risk to users of the affected application. The confidentiality and integrity risks are inferred from the CVE description's focus on cross‑site scripting, as they are not explicitly listed in the original CVE text.