lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve…

lxml, a Python library for processing XML and HTML, contains a vulnerability prior to version 6.1.0 that allows local file access through XML entity resolution. The vulnerability exists in the default parser configuration with resolve_entities=True, enabling untrusted XML input to read local files. Users can mitigate by setting resolve_entities to 'internal' or False. The issue is fixed in lxml version 6.1.0.