CVE-2026-49825CWE-184CWE-79cross-site-scripting

CVE-2026-49825

High · published August 20, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.2th percentile
Weaknesses
CWE-184 · Incomplete List of Disallowed Inputs; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-20T19:17Z
References (6)
https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2 · [email protected]https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5 · [email protected]https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f · [email protected]https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0 · [email protected]https://github.com/lxml/lxml/releases/tag/lxml-6.1.1 · [email protected]https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 AUG 14:42Z
    lxml: javascript: URL bypass in Cleaner via xlink:href
    cvelistv5