p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de lxml

Vulnerabilidades publicadas para lxml en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 2

  1. CVE-2026-49825

    Alta · CVSS 8.2EPSS 0,3%Corrección disponible

    lxml: javascript: URL bypass in Cleaner via xlink:href

    lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

    lxmlSistemas operativos
    • Actualiza a 5.2.1-1ubuntu0.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-41066

    Alta · CVSS 7.5EPSS 0,32%Corrección disponible

    lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

    lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

    lxmlSistemas operativos
    • Actualiza a 5.2.1-1ubuntu0.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →