CVE-2026-49825

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49825
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49825.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49825
Aliases
Downstream
ALSA (3)
AZL (1)
BELL (1)
CLSA (2)
DEBIAN (1)
ECHO (1)
MINI (2)
OESA (1)
openSUSE (2)
RHSA (12)
RLSA (3)
SUSE (6)
UBUNTU (1)
Related
ALSA (3)
openSUSE (2)
SUSE (6)
Published
2026-08-20T14:42:30Z
Modified
2026-10-28T02:30:29Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
lxml: javascript: URL bypass in Cleaner via xlink:href
Details

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.link_attrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-184",
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49825.json"
}
References

Affected packages

Git / github.com/fedora-python/lxml_html_clean

Affected ranges

Type
GIT
Repo
https://github.com/fedora-python/lxml_html_clean
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
322357ac61c6cf80fcbaba53b4e92e31f3ded9f2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.4.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "322357ac61c6cf80fcbaba53b4e92e31f3ded9f2"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "0.4.5",
            "range":  [
                {
                    "fixed":  "322357ac61c6cf80fcbaba53b4e92e31f3ded9f2"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}
Type
GIT
Repo
https://github.com/lxml/lxml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b4a4c595fb875d6f50ae113449834209a364643a
Fixed
5927a6d5e851845140975d99b65461e255caaab0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "6.1.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "5927a6d5e851845140975d99b65461e255caaab0"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "lxml-6.1.1",
            "range":  [
                {
                    "fixed":  "b4a4c595fb875d6f50ae113449834209a364643a"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
lxml-0.*
lxml-0.5.1
lxml-0.6
lxml-0.7
lxml-0.9
lxml-1.*
lxml-1.0
lxml-1.0.beta
lxml-1.1
lxml-1.1alpha
lxml-1.1beta
lxml-1.2
lxml-2.*
lxml-2.0
lxml-2.0.1
lxml-2.0alpha1
lxml-2.0alpha2
lxml-2.0alpha3
lxml-2.0alpha4
lxml-2.0alpha5
lxml-2.0alpha6
lxml-2.0beta1
lxml-2.0beta2
lxml-2.1
lxml-2.1alpha1
lxml-2.1beta1
lxml-2.1beta2
lxml-2.1beta3
lxml-2.2
lxml-2.2.1
lxml-2.2.2
lxml-2.3
lxml-2.3.1
lxml-2.3alpha1
lxml-2.3alpha2
lxml-2.3beta1
lxml-3.*
lxml-3.0
lxml-3.0.1
lxml-3.0alpha1
lxml-3.0alpha2
lxml-3.0beta1
lxml-3.1.0
lxml-3.1.1
lxml-3.1beta1
lxml-3.2.0
lxml-3.2.1
lxml-3.2.2
lxml-3.2.3
lxml-3.3.0
lxml-3.3.0beta1
lxml-3.3.0beta2
lxml-3.3.0beta3
lxml-3.3.0beta4
lxml-3.3.0beta5
lxml-3.3.1
lxml-3.3.2
lxml-3.3.3
lxml-3.4.0
lxml-3.4.0beta1
lxml-3.4.1
lxml-3.5.0
lxml-3.5.0b1
lxml-3.6.0
lxml-3.6.1
lxml-3.7.0
lxml-3.7.1
lxml-3.7.2
lxml-3.8.0
lxml-3.8.0-py27fix
lxml-4.*
lxml-4.0.0
lxml-4.1.0
lxml-4.1.1
lxml-4.2.0
lxml-4.2.1
lxml-4.2.2
lxml-4.3.0
lxml-4.3.1
lxml-4.3.2
lxml-4.4.0
lxml-4.4.1
lxml-4.5.0
lxml-4.5.1
lxml-4.5.2
lxml-4.6.0
lxml-4.6.1
lxml-4.6.2
lxml-4.6.3
lxml-4.7.0
lxml-4.7.0-pre
lxml-4.7.1
lxml-4.8.0
lxml-4.9.0
lxml-4.9.1
lxml-4.9.2
lxml-5.*
lxml-5.0.0
lxml-5.0a0
lxml-5.1.0
lxml-5.1.0-1
lxml-5.1.0-2
lxml-5.1.1
lxml-5.2.0
lxml-5.2.1
lxml-5.3.0
lxml-6.*
lxml-6.0.0
lxml-6.0.1
lxml-6.0.2
lxml-6.0.3
lxml-6.0.4
lxml-6.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49825.json"