CVE-2026-41066: lxml
CVSS: 7.5v3.1HighAnalyzed
AliasesALPINE-CVE-2026-41066SUSE-SU-2026:2488-1SUSE-SU-2026:2728-1SUSE-SU-2026:2729-1SUSE-SU-2026:2752-1SUSE-SU-2026:2754-1GHSA-vfmq-68hx-4jfwPYSEC-2026-87UBUNTU-CVE-2026-41066DEBIAN-CVE-2026-41066CGA-25m7-89cv-36hqCGA-3rr6-rc55-p7frCGA-3rvf-7gc4-j52jCGA-6pwp-cjv4-f889CGA-7ch9-55mg-5hj5CGA-96j2-877j-5f8pCGA-9q38-r8c2-28mwCGA-cwc2-rg5w-m54hCGA-ff7h-j55x-g2mpCGA-hf3r-9f33-q8x5CGA-hfq9-5jc7-64qvCGA-m26f-w5p3-m773CGA-mrw4-3wq5-jc3xCGA-p45g-7867-374rCGA-p9gv-46w5-76rfCGA-qhgx-hq7g-5v3wCGA-r5xx-4rp4-25wxopenSUSE-SU-2026:10596-1CGA-3wj4-3m6r-6v9cCGA-3x89-qpm2-qxp9CGA-4866-449p-qx32CGA-53pj-m59h-f6q3CGA-5gpj-7qcp-g52gCGA-5vg5-fjcf-8wphCGA-6xfv-3wfw-9gj4CGA-79cm-m784-m63pCGA-7hfh-43wr-63hcCGA-7w9v-4662-mqhpCGA-854v-wfmf-pm3qCGA-87m7-329x-9f79CGA-8cv8-63gv-fp89CGA-95g9-vgqw-6595CGA-c2v6-ccmr-vr22CGA-fm6p-q3c7-wqwpCGA-g979-m4cx-g5x5CGA-gcjw-x6gw-6vq6CGA-hq69-whgj-fc7rCGA-mcj3-8r9g-72cwCGA-mv8q-fhjc-fmmxCGA-pg9h-frr9-f8w9CGA-ppjv-c3rh-g447CGA-q986-849c-j899CGA-qmp2-55wv-q4h2CGA-rrhj-j6fw-h4r5CGA-vh9x-6543-7c3xCGA-wc22-7mfm-vrg7CGA-wqq2-46w8-g825CGA-ww83-vwv3-v87cCGA-xg9v-w856-69xcCGA-xrxr-p3gm-9fg7
Published 24-04-2026Last modified 24-04-2026
Vulnerability summary
CVE-2026-41066 is a high (CVSS 7.5) vulnerability in lxml. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.32%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 7 · Related 8Timeline
- 24-04-2026PublishedVulnerability first disclosed.
- 24-04-2026Last modifiedVulnerability information updated.
Description
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.
CVSS metrics
8 scores · 8 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 8 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
0.00 pp
From 0.32% on 19-09-2026
19-09-202619-10-2026
EPSS score0.32%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugs.launchpad.net)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard28 products
- airflow-2All versions (No fix recorded)
- airflow-3< 3.2.1-r1
- authentik-2025.12< 2025.12.4-r5
- authentik-fips-2025.12< 2025.12.4-r4
- awx< 24.6.1-r49
Wolfi10 products
- airflow-3< 3.2.1-r1
- datadog-agent-7.72-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.73-core-integrations< 7.73.3-r23
- datadog-agent-7.74-core-integrations< 7.74.1-r24
- datadog-agent-7.75-core-integrationsAll versions (No fix recorded)
Suse7 products
- python-lxml&distro=SUSE Linux Enterprise Micro 5.3< 4.7.1-150200.3.15.1
- python-lxml&distro=SUSE Linux Enterprise Micro 5.4< 4.7.1-150200.3.15.1
- python-lxml&distro=SUSE Linux Enterprise Module for Python 3 15 SP7< 4.9.3-150400.8.11.1
- python-lxml&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 3.6.1-8.8.1
- python3-lxml&distro=SUSE Linux Enterprise Micro 5.5< 4.9.1-150500.3.7.1
Alpine1 product
- py3-lxml< 6.1.0-r0
Debian1 product
- lxml< 4.9.2-1+deb12u1 | All versions (No fix recorded) | < 6.1.0-1
Lxml1 product
- lxml< 6.1.0
Opensuse1 product
- python-lxml&distro=openSUSE Tumbleweed< 6.1.0-1.1
PyPI1 product
- lxml< 6.1.0
Ubuntu1 product
- lxml< 3.3.3-1ubuntu0.2+esm6 | < 3.5.0-1ubuntu0.4+esm3 | < 4.2.1-1ubuntu0.6+esm1 | < 4.5.0-1ubuntu0.5+esm1 | < 4.8.0-1ubuntu0.1 | < 5.2.1-1ubuntu0.2 | All versions (No fix recorded) | < 6.0.2-1ubuntu0.1
9 vendors · 51 products
References
19 links- github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfwX Refsource CONFIRMWEBAdvisoryREPORTMitigationVendor Advisory
- bugs.launchpad.net/lxml/+bug/2146291X Refsource MISCWEBREPORTExploitIssue TrackingThird Party Advisory
Show all 19 references
- github.com/lxml/lxmlPACKAGE
