lxml-html-clean

What it is and what it does

lxml_html_clean is a standalone HTML sanitization library extracted from lxml's original cleaner module. It uses a blocklist-based approach to remove unwanted HTML tags and attributes from user-supplied or untrusted content. The package depends only on lxml and installs as a pure Python wheel.

The package explicitly warns that it is not suitable for security-sensitive environments. Its URL parsing relies on Python's urllib.parse, which does not validate inputs, and a maliciously crafted URL could bypass the allowed-hosts check. If you need robust HTML sanitization for high-security contexts, the maintainers recommend alternatives like nh3.

Use it for:

• Sanitize user-submitted HTML in a blog or comment system where moderate filtering suffices
• Remove script tags and event handlers from HTML copied from untrusted web sources
• Clean up HTML content for display in a non-security-critical web application
• Strip formatting and styling from HTML while preserving structure for content migration

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Cleans and sanitizes HTML by removing unwanted tags and attributes using a blocklist approach, extracted from lxml's original HTML cleaner module.

Yes, if you need basic HTML sanitization in a non-security-critical context. The package is actively maintained, has low install friction, and carries a permissive license. However, do not use it for security-sensitive applications—the maintainers explicitly recommend alternatives like nh3 for those cases. Verify that blocklist-based filtering meets your specific requirements.

Install

lxml-html-clean on PyPI

pip install lxml-html-clean

uv add lxml-html-clean

poetry add lxml-html-clean

Installing lxml-html-clean

Before you install

Low friction: pure Python wheel with a single runtime dependency on lxml. Actively maintained as of 2026-05-20 with recent releases.

License in practice

BSD-3-Clause permissive license allows commercial and private use with minimal restrictions; attribution required.

Quickstart

pip install lxml_html_clean

from lxml_html_clean import Cleaner

cleaner = Cleaner()
clean_html = cleaner.clean_html('<p>Hello <script>alert(1)</script></p>')

Requires lxml, which may need compilation on some systems. Not recommended for security-sensitive applications—see package documentation for alternatives.

Verify before relying

• Whether the blocklist approach provides adequate protection for your specific use case, given the package's own warning against security-sensitive environments
• Whether URL parsing via urllib.parse's non-validating functions poses a risk for your allowed-hosts configuration

Package facts

Evidence: lxml_html_clean-0.4.5-py3-none-any.whl

Tags

More HTML packages