{"schemaVersion":3,"id":"USN-8897-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"lxml vulnerabilities\n\nGuillem Lefait discovered that lxml incorrectly handled certain URL\nattributes. A remote attacker could possibly use this issue to bypass\nURL sanitization, leading to a cross-site scripting attack.\n(CVE-2026-49825)\n\nQiu Sihao discovered that lxml incorrectly handled untrusted XML input.\nA remote attacker could possibly use this issue to read local files and\nexpose sensitive information. This issue was only addressed in Ubuntu 24.04\nLTS and Ubuntu 26.04 LTS. (CVE-2026-41066)","dates":{"published":"2026-10-07T16:13:52.000Z","modified":"2026-10-08T19:58:54.170Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"lxml","name":"lxml","label":"lxml","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/lxml","purlType":"deb","versions":[{"text":"< 3.3.3-1ubuntu0.2+esm6","noFixRecorded":false,"fixedIn":null},{"text":"< 3.5.0-1ubuntu0.4+esm3","noFixRecorded":false,"fixedIn":null},{"text":"< 4.2.1-1ubuntu0.6+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 4.5.0-1ubuntu0.5+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 4.8.0-1ubuntu0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 5.2.1-1ubuntu0.2","noFixRecorded":false,"fixedIn":null},{"text":"< 6.0.2-1ubuntu0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.3-1ubuntu0.2+esm6 | < 3.5.0-1ubuntu0.4+esm3 | < 4.2.1-1ubuntu0.6+esm1 | < 4.5.0-1ubuntu0.5+esm1 | < 4.8.0-1ubuntu0.1 | < 5.2.1-1ubuntu0.2 | < 6.0.2-1ubuntu0.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8897-1","label":"ubuntu.com/security/notices/USN-8897-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41066","label":"ubuntu.com/security/CVE-2026-41066","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-49825","label":"ubuntu.com/security/CVE-2026-49825","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2026-41066","CVE-2026-49825"],"downstream":[],"duplicates":[],"related":["CVE-2026-41066","CVE-2026-49825"]},"timeline":[{"kind":"published","date":"2026-10-07T16:13:52.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-08T19:58:54.170Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:59:44.767Z","stale":false,"partial":false}}