Lxml Lxml vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Lxml Lxml: 2 record(s), with affected versions and fixes.
cpe:2.3:a:lxml:lxml

CVE-2026-49825 High · 8.2 CWE-79 Aug 20, 2026

lxml: javascript: URL bypass in Cleaner via xlink:href

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

CVE-2026-41066 High · 7.5 CWE-611 Apr 24, 2026

lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.