Vulnerabilities for lxml

First version without a known vulnerability: 6.1.0

Details

• GHSA-vfmq-68hx-4jfw2026-04-21

  lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

  Fixed in: 6.1.0

• GHSA-wrxv-2j5q-m38w2022-07-06

  lxml NULL Pointer Dereference allows attackers to cause a denial of service

  Fixed in: 4.9.1, 86368e9cf70a0ad23cccd5ee32de847149af0c6f

• GHSA-57qw-cc2g-pv5p2022-05-14

  lxml Cross-site Scripting Via Control Characters

  Fixed in: 3.3.5

• GHSA-xp26-p53h-6h2p2022-05-13

  Improper Neutralization of Input During Web Page Generation in LXML

  Fixed in: 4.2.5, 6be1d081b49c97cfd7b3fbd934a193b668629109

• GHSA-55x5-fj6c-h6m82021-12-13

  lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through

  Fixed in: 4.6.5, f2330237440df7e8f39c3ad1b1aa8852be3b27c0, 12fa9669007180a7bb87d990c375cf91ca5b664a, a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c

• GHSA-jq4v-f5q6-mjqq2021-03-22

  lxml vulnerable to Cross-Site Scripting

  Fixed in: 4.6.3, a5f9cb52079dc57477c460dbe6ba0f775e14a999

• GHSA-pgww-xf46-h92r2021-01-07

  lxml vulnerable to Cross-site Scripting

  Fixed in: 4.6.2