p PatchFirst

PatchFirst · Latest vulnerabilities

lxml vulnerabilities

Vulnerabilities published for lxml in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-49825

    High · CVSS 8.2EPSS 0.3%Fix available

    lxml: javascript: URL bypass in Cleaner via xlink:href

    lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

    lxmlOperating systems
    • Update to 6.0.2-1ubuntu0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-41066

    High · CVSS 7.5EPSS 0.32%Fix available

    lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

    lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

    lxmlOperating systems
    • Update to 6.0.2-1ubuntu0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →