diff --git a/src/lxml/html/defs.py b/src/lxml/html/defs.py

index caf6b21..ea3c016 100644

--- a/src/lxml/html/defs.py

+++ b/src/lxml/html/defs.py

@@ -21,6 +21,8 @@ link_attrs = frozenset([

     'usemap',

     # Not standard:

     'dynsrc', 'lowsrc',

+    # HTML5 formaction

+    'formaction'

     ])

 # Not in the HTML 4 spec:

diff --git a/src/lxml/html/tests/test_clean.py b/src/lxml/html/tests/test_clean.py

index 451eec2..e40cdad 100644

--- a/src/lxml/html/tests/test_clean.py

+++ b/src/lxml/html/tests/test_clean.py

@@ -89,6 +89,21 @@ class CleanerTest(unittest.TestCase):

             b'<math><style>/* deleted */</style></math>',

             lxml.html.tostring(clean_html(s)))

+    def test_formaction_attribute_in_button_input(self):

+        # The formaction attribute overrides the form's action and should be

+        # treated as a malicious link attribute

+        html = ('<form id="test"><input type="submit" formaction="javascript:alert(1)"></form>'

+        '<button form="test" formaction="javascript:alert(1)">X</button>')

+        expected = ('
<form id="test"><input type="submit" formaction=""></form>'

+        '<button form="test" formaction="">X</button>')

+        cleaner = Cleaner(

+            forms=False,

+            safe_attrs_only=False,

+        )

+        self.assertEqual(

+            expected,

+            cleaner.clean_html(html))

+

 def test_suite():

     suite = unittest.TestSuite()