URL Bypass Vulnerability in lxml Library by lxml Developers
CVE-2026-49825

8.2HIGH

Key Information:

Vendor

Lxml

Status
Lxml
Lxml Html Clean
Vendor
CVE Published:
20 August 2026

What is CVE-2026-49825?

The lxml library, a popular tool for XML and HTML processing in Python, had a vulnerability related to missing link attributes in 'lxml.html.defs.link_attrs'. Specifically, the absence of 'xlink:href' allowed for the potential of URL bypass attacks in embedded SVG, MathML, and similar content. This issue, affecting versions prior to 6.1.1 and lxml_html_clean before 0.4.5, has been addressed in subsequent releases, ensuring improved security for users of the library.

Affected Version(s)

lxml < 6.1.1

lxml_html_clean < 0.4.5

References

https://github.com/fedora-python/lxml_html_clean/security...
x_refsource_CONFIRM
https://github.com/fedora-python/lxml_html_clean/commit/3...
x_refsource_MISC
https://github.com/lxml/lxml/commit/5927a6d5e851845140975...
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.