The lxml and lxml_html_clean libraries are vulnerable to Cross-site Scripting due to improper input sanitization, posing a risk of unauthorized script execution.

This vulnerability is classified as CWE-79 and CWE-184, involving the improper neutralization of input during web page generation and the use of incomplete lists of disallowed inputs. The attack vector is network-based and can be performed without authentication, though it requires user interaction.

With a CVSS score of 8.2, this vulnerability represents a significant risk to web applications using these libraries. Exploitation allows for Cross-site Scripting, which can lead to session hijacking, theft of sensitive user data, or unauthorized actions performed on behalf of users within the affected application.

Immediate Action: Update lxml to version 6.1.1 and lxml_html_clean to version 0.4.5 or later.

Proactive Monitoring: Review web application logs for suspicious input patterns or attempts to inject malicious scripts into forms and data fields.

Compensating Controls: Implement a robust Content Security Policy (CSP) to mitigate the impact of potential XSS attacks by restricting the sources from which scripts can be executed.

Public Exploit Available: No (unknown)

The presence of a proof-of-concept and the high severity of XSS vulnerabilities necessitate immediate action. Developers and system administrators must prioritize the update of these libraries to the specified fixed versions to prevent potential exploitation.