Summary
Guillem Lefait discovered that lxml incorrectly handled certain URL
attributes. A remote attacker could possibly use this issue to bypass
URL sanitization, leading to a cross-site scripting attack.
(CVE-2026-49825)
Qiu Sihao discovered that lxml incorrectly handled untrusted XML input.
A remote attacker could possibly use this issue to read local files and
expose sensitive information. This issue was only addressed in Ubuntu 24.04
LTS and Ubuntu 26.04 LTS. (CVE-2026-41066)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | lxml | 4.8.0-1ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | lxml | 5.2.1-1ubuntu0.2 |
| Ubuntu · 26.04 LTS 26.04:LTS | lxml | 6.0.2-1ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | lxml | 3.3.3-1ubuntu0.2+esm6 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | lxml | 3.5.0-1ubuntu0.4+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | lxml | 4.2.1-1ubuntu0.6+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | lxml | 4.5.0-1ubuntu0.5+esm1 |
Vulnerabilities 2
-
High 8.2
lxml: javascript: URL bypass in Cleaner via xlink:href
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerabilit…
-
High 7.5
lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option…