lxml vulnerabilities (Debian)

13 vulnerabilities.

• lxml Debian lxml: javascript: URL bypass in Cleaner via xlink:href CVE-2026-49825 Fix available 8.2 HighJune 29, 2026
• lxml Debian lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files CVE-2026-41066 Fix available 7.5 HighApril 21, 2026
• lxml Debian lxml_html_clean: <base> tag injection through default Cleaner configuration CVE-2026-28350 Fix available 6.1 MediumMarch 2, 2026
• lxml Debian lxml_html_clean: CSS @import Filter Bypass via Unicode Escapes CVE-2026-28348 Fix available 6.1 MediumMarch 2, 2026
• lxml Debian NULL Pointer Dereference in lxml/lxml CVE-2022-2309 Fix available 5.3 MediumJuly 5, 2022
• lxml Debian HTML Cleaner allows crafted and SVG embedded scripts to pass through CVE-2021-43818 Fix available 8.2 HighDecember 13, 2021
• lxml Debian lxml vulnerable to Cross-Site Scripting CVE-2021-28957 Fix available 6.1 MediumMarch 21, 2021
• lxml Debian lxml - regression update DSA-4810-2 Fix available No scoreDecember 19, 2020
• lxml Debian lxml - regression update DLA-2467-2 Fix available No scoreDecember 18, 2020
• lxml Debian lxml vulnerable to Cross-site Scripting CVE-2020-27783 Fix available 6.1 MediumNovember 26, 2020
• lxml Debian lxml - security update DLA-1604-1 Fix available No scoreDecember 10, 2018
• lxml Debian Improper Neutralization of Input During Web Page Generation in LXML CVE-2018-19787 Fix available 6.1 MediumDecember 2, 2018
• lxml Debian lxml Cross-site Scripting Via Control Characters CVE-2014-3146 Public exploitFix available 4.3 MediumMay 14, 2014