Logo
›
›component›python3-lxml
Name
python3-lxml
Version
5.0.2
Type
library
Description
Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.
Licenses
BSD-3-Clause & GPL-2.0-only & MIT & PSF-2.0
PURL
-
CPE
cpe:2.3:*:*:python3-lxml:5.0.2:*:*:*:*:*:*:*

Other Versions#


Project
Branch
Version
kirkstone
4.8.0
master
6.1.3

Patches#


#
Title
Author
Resolve
1
LP#2146291: Set "resolve_entities='internal'" as default for
Stefan Behnel <stefan_ml@behnel.de>
CVE-2026-41066

Vulnerabilities#


Name
Analysis
Description
Patched
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.