CVE-2026-49825 — lxml: javascript: URL bypass in Cleaner via xlink:href
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be …
Published: 2026-08-20 · CVSS: 8.2 · CVSS 3.1
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7