CVE-2026-41066-nvd.nist.gov-Undergoing Analysis

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve…

Published:

23 April 2026 at 22:00:00

Alert date:

24 April 2026 at 19:03:24

Source:

nvd.nist.gov

Supply Chain & Dependencies, Web Technologies

lxml, a Python library for processing XML and HTML, contains a vulnerability prior to version 6.1.0 that allows local file access through XML entity resolution. The vulnerability exists in the default parser configuration with resolve_entities=True, enabling untrusted XML input to read local files. Users can mitigate by setting resolve_entities to 'internal' or False. The issue is fixed in lxml version 6.1.0.

Technical details

Mitigation steps:

Affected products:

lxml