Security Concern: XSS Vulnerability in html5lib 1.1 – Request for Patch or Release Timeline #613

Hello html5lib Maintainers and Community,

We are using html5lib==1.1 as a transitive dependency of xhtml2pdf==0.2.28 in our application.

Our security scanning tool, Snyk, has reported a Cross-Site Scripting (XSS) vulnerability associated with html5lib 1.1.

We understand that the vulnerability is related to the handling of potentially unsafe HTML attributes and that a patched version may not currently be available.

Could the maintainers please clarify the following?

1. Is this vulnerability acknowledged by the html5lib maintainers?
2. Is a security patch planned for an upcoming release?
3. Is there an estimated timeline for releasing a patched version?
4. Is there a recommended workaround or mitigation for applications that depend on html5lib through other packages, such as xhtml2pdf?

As this vulnerability is impacting our security compliance and release process, any guidance from the maintainers or community would be greatly appreciated.

Thank you for maintaining this project and for your support.