8.2

CVE-2026-49825: fedora-python lxml_html_clean Cross-site Scripting

CVSS: 8.2v3.1HighAwaiting analysis
AliasesGHSA-4jhm-jv67-739fPYSEC-2026-2614RHSA-2026:66203
Published 20-08-2026Last modified 21-08-2026
Open JSON

Vulnerability summary

CVE-2026-49825 is a high (CVSS 8.2) Cross-site Scripting vulnerability in fedora-python lxml_html_clean. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 20.9% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v3.1 (CVE.org)
EPSS score
0.30%
0%100%
Low · +0.06 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 8
OPENSUSE-SU-2026:11147-1RHSA-2026:74505RHSA-2026:74506SUSE-SU-2026:4580-1SUSE-SU-2026:4581-1SUSE-SU-2026:4582-1

Timeline

  1. 20-08-2026
    PublishedVulnerability first disclosed.
  2. 21-08-2026
    Last modifiedVulnerability information updated.

Description

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

+0.06 pp

From 0.24% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat7 products
  • python-lxml< 0:4.6.5-3.el9_8.1 | < 0:4.6.5-3.el9_6.1 | < 0:4.6.5-3.el9_4.1 | < 0:4.6.5-3.el9_2.1 | < 0:4.2.3-5.el8_10 | < 0:4.2.3-4.el8_6.1 | < 0:4.2.3-4.el8_8.1
  • python-lxml-debugsource< 0:4.6.5-3.el9_8.1 | < 0:4.6.5-3.el9_6.1 | < 0:4.6.5-3.el9_4.1 | < 0:4.6.5-3.el9_2.1 | < 0:4.2.3-5.el8_10 | < 0:4.2.3-4.el8_6.1 | < 0:4.2.3-4.el8_8.1
  • python3-lxml< 0:4.6.5-3.el9_8.1 | < 0:4.6.5-3.el9_6.1 | < 0:4.6.5-3.el9_4.1 | < 0:4.6.5-3.el9_2.1 | < 0:4.2.3-5.el8_10 | < 0:4.2.3-4.el8_6.1 | < 0:4.2.3-4.el8_8.1
  • python3-lxml-debuginfo< 0:4.6.5-3.el9_8.1 | < 0:4.6.5-3.el9_6.1 | < 0:4.6.5-3.el9_4.1 | < 0:4.6.5-3.el9_2.1 | < 0:4.2.3-5.el8_10 | < 0:4.2.3-4.el8_6.1 | < 0:4.2.3-4.el8_8.1
  • python3.12-lxml< 0:4.9.3-2.el9_8.1 | < 0:4.9.3-2.el9_6.1 | < 0:4.9.3-2.el9_4.1
Debian2 products
  • lxml< 4.9.2-1+deb12u1 | All versions (No fix recorded) | < 6.1.3-1
  • lxml-html-cleanAll versions (No fix recorded) | < 0.4.5-1
Fedora-python1 product
Lxml1 product
Opensuse1 product
  • python-lxml_html_clean&distro=openSUSE Tumbleweed< 0.4.5-1.1
PyPI1 product
  • lxml-html-clean< 0.4.5
Ubuntu1 product
  • lxml< 3.3.3-1ubuntu0.2+esm6 | < 3.5.0-1ubuntu0.4+esm3 | < 4.2.1-1ubuntu0.6+esm1 | < 4.5.0-1ubuntu0.5+esm1 | < 4.8.0-1ubuntu0.1 | < 5.2.1-1ubuntu0.2 | < 6.0.2-1ubuntu0.1

7 vendors · 14 products

References

37 links
Show all 37 references