CVE-2026-41066

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41066
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-41066.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-41066
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CGA (55)
CLEANSTART (18)
CLSA (2)
DEBIAN (1)
ECHO (1)
MINI (8)
OESA (5)
openSUSE (2)
ROOT (1)
SUSE (8)
UBUNTU (1)
Related
openSUSE (2)
SUSE (8)
Published
2026-04-24T16:45:19Z
Modified
2026-08-12T03:30:17Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
Details

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-611"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41066.json"
}
References

Affected packages

Git / github.com/lxml/lxml

Affected ranges

Type
GIT
Repo
https://github.com/lxml/lxml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
43722f4402afa48b7890a96ce012eb0b9b1af5be
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "6.1.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

lxml-0.*
lxml-0.5.1
lxml-0.6
lxml-0.7
lxml-0.9
lxml-1.*
lxml-1.0
lxml-1.0.beta
lxml-1.1
lxml-1.1alpha
lxml-1.1beta
lxml-1.2
lxml-2.*
lxml-2.0
lxml-2.0.1
lxml-2.0alpha1
lxml-2.0alpha2
lxml-2.0alpha3
lxml-2.0alpha4
lxml-2.0alpha5
lxml-2.0alpha6
lxml-2.0beta1
lxml-2.0beta2
lxml-2.1
lxml-2.1alpha1
lxml-2.1beta1
lxml-2.1beta2
lxml-2.1beta3
lxml-2.2
lxml-2.2.1
lxml-2.2.2
lxml-2.3
lxml-2.3.1
lxml-2.3alpha1
lxml-2.3alpha2
lxml-2.3beta1
lxml-3.*
lxml-3.0
lxml-3.0.1
lxml-3.0alpha1
lxml-3.0alpha2
lxml-3.0beta1
lxml-3.1.0
lxml-3.1.1
lxml-3.1beta1
lxml-3.2.0
lxml-3.2.1
lxml-3.2.2
lxml-3.2.3
lxml-3.3.0
lxml-3.3.0beta1
lxml-3.3.0beta2
lxml-3.3.0beta3
lxml-3.3.0beta4
lxml-3.3.0beta5
lxml-3.3.1
lxml-3.3.2
lxml-3.3.3
lxml-3.4.0
lxml-3.4.0beta1
lxml-3.4.1
lxml-3.5.0
lxml-3.5.0b1
lxml-3.6.0
lxml-3.6.1
lxml-3.7.0
lxml-3.7.1
lxml-3.7.2
lxml-3.8.0
lxml-3.8.0-py27fix
lxml-4.*
lxml-4.0.0
lxml-4.1.0
lxml-4.1.1
lxml-4.2.0
lxml-4.2.1
lxml-4.2.2
lxml-4.3.0
lxml-4.3.1
lxml-4.3.2
lxml-4.4.0
lxml-4.4.1
lxml-4.5.0
lxml-4.5.1
lxml-4.5.2
lxml-4.6.0
lxml-4.6.1
lxml-4.6.2
lxml-4.6.3
lxml-4.7.0
lxml-4.7.0-pre
lxml-4.7.1
lxml-4.8.0
lxml-4.9.0
lxml-4.9.1
lxml-4.9.2
lxml-5.*
lxml-5.0.0
lxml-5.0a0
lxml-5.1.0
lxml-5.1.0-1
lxml-5.1.0-2
lxml-5.1.1
lxml-5.2.0
lxml-5.2.1
lxml-5.3.0
lxml-6.*
lxml-6.0.0
lxml-6.0.1
lxml-6.0.2
lxml-6.0.3
lxml-6.0.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-41066.json"