SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-49825

HIGH · CVSS 8.2 EPSS 0.24% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-20 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The lxml library, used for processing XML and HTML in Python, is vulnerable to URL bypass attacks due to missing `xlink:href` attributes in link definitions prior to version 6.1.1. This flaw can allow attackers to manipulate embedded SVG or MathML content, potentially leading to unauthorized access or data exposure. Developers and organizations utilizing lxml versions before 6.1.1 should prioritize upgrading to mitigate this high-severity risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-49825
Severity
HIGH
CVSS
8.2
EPSS
0.24%

Original NVD Description

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.