PT-2026-34232 · Pypi · Lxml

Brubbish · Published 2026-04-21 · Updated 2026-04-29 · CVE-2026-41066

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions lxml versions prior to 6.1.0

Description Using the default configuration with the resolve entities variable set to True allows untrusted XML input to read local files. This issue affects the iterparse() and ETCompatXMLParser() functions.

Recommendations Update to version 6.1.0. As a temporary workaround, explicitly set the resolve entities variable to internal or False to disable local file access.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-41066

ECHO-E83F-9E30-4171

GHSA-VFMQ-68HX-4JFW

OESA-2026-2008

OESA-2026-2009

OESA-2026-2010

OESA-2026-2011

OESA-2026-2012

OPENSUSE-SU-2026:10596-1

PYSEC-2026-87

Affected Products

Lxml

References · 31

• 🔥 https://bugs.launchpad.net/lxml/+bug/2146291 · Exploit
• https://github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2009 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2010 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41066 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2012 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41066 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vfmq-68hx-4jfw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41066 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-41066 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-41066 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10596-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-41066 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41066 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-87 · Vendor Advisory