lxml

PyPI · Package

7 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local filesCVE-2026-41066 · GHSA-VFMQ-68HX-4JFWVersion ranges need review.	lxml Migration Toolkit for Applications 8/mta/mta-solution-server-rhel9	PyPIRed Hat	High	Fix reported	2026-09-10
lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass throughCVE-2021-43818 · GHSA-55X5-FJ6C-H6M8Version ranges need review.	lxml Red Hat Ansible Automation Platform 1.2/lxml	PyPIRed Hat	Medium	Fix reported	2026-07-08
lxml Cross-site Scripting Via Control CharactersCVE-2014-3146 · GHSA-57QW-CC2G-PV5PVersion ranges need review.	lxml Red Hat Enterprise Linux 5/python-lxml	PyPIRed Hat	Medium	Fix reported	2026-06-10
Improper Neutralization of Input During Web Page Generation in LXMLCVE-2018-19787 · GHSA-XP26-P53H-6H2PVersion ranges need review.	lxml Red Hat Enterprise Linux 5/python-lxml	PyPIRed Hat	Medium	Fix reported	2025-12-20
lxml vulnerable to Cross-site ScriptingCVE-2020-27783 · GHSA-PGWW-XF46-H92RVersion ranges need review.	lxml Red Hat Enterprise Linux 5/python-lxml	PyPIRed Hat	Medium	Fix reported	2025-12-20
lxml NULL Pointer Dereference allows attackers to cause a denial of serviceCVE-2022-2309 · GHSA-WRXV-2J5Q-M38WVersion ranges need review.	lxml Red Hat Enterprise Linux 9/inkscape:flatpak/python-lxml	PyPIRed Hat	Medium	Fix reported	2025-11-05
lxml vulnerable to Cross-Site Scripting CVE-2021-28957 · GHSA-JQ4V-F5Q6-MJQQVersion ranges need review.	lxml Red Hat Ansible Automation Platform 1.2/lxml	PyPIRed Hat	Medium	Fix reported	2024-09-30