CVE-2026-41066

Katalog CVE

CVSS 7.5 · High EPSS 0,32%

Kerentanan Improper Restriction of XML External Entity Reference pada lxml. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

Rincian

Terbit di NVD

24 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw mitigasi · advisory vendor
• https://bugs.launchpad.net/lxml/+bug/2146291 exploit · issue tracking · advisory pihak ketiga