Bug 2520368 (CVE-2026-49825) - CVE-2026-49825 lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href
Summary: CVE-2026-49825 lxml: lxml-html-clean: lxml: URL bypass vulnerability in Clean...
Keywords:
Status: NEW
Alias: CVE-2026-49825
Product: Security Response
Classification: Other
Component: vulnerability-draft
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-20 15:05 UTC by OSIDB Bzimport
Modified: 2026-08-28 03:00 UTC (History)
86 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-20 15:05:11 UTC 
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.
Note You need to log in before you can comment on or make changes to this bug.