Log in Start free

Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M

CVE-2026-41066lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

High 7.5

In plain English

A high-severity XML external entity in lxml from lxml. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 74.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24py3-lxml6.1.0-r0ALPINE-CVE-2026-41066
Debian:12lxml4.9.2-1+deb12u1DEBIAN-CVE-2026-41066
Debian:13lxmlno fix listedDEBIAN-CVE-2026-41066
Debian:14lxml6.1.0-1DEBIAN-CVE-2026-41066
PyPIlxml6.1.0GHSA-vfmq-68hx-4jfw
PyPIlxml6.1.0PYSEC-2026-87
Ubuntu:22.04:LTSlxml4.8.0-1ubuntu0.1USN-8897-1
Ubuntu:22.04:LTSlxml4.8.0-1ubuntu0.1UBUNTU-CVE-2026-41066
Ubuntu:24.04:LTSlxml5.2.1-1ubuntu0.2USN-8897-1
Ubuntu:24.04:LTSlxml5.2.1-1ubuntu0.2UBUNTU-CVE-2026-41066
Ubuntu:25.10lxmlno fix listedUBUNTU-CVE-2026-41066
Ubuntu:26.04:LTSlxml6.0.2-1ubuntu0.1UBUNTU-CVE-2026-41066
Ubuntu:26.04:LTSlxml6.0.2-1ubuntu0.1USN-8897-1

Affected products (as reported)

VendorProductVersions
lxml lxml < 6.1.0

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References