CVE-2026-41066

🗓️ 24 Apr 2026 16:45:19Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 113 Views

Default parsers allow local file access via entities; set resolve_entities to internal or False; fixed in 6.1.0.

Reporter	Title	Published	Views	Family All 107
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by an XML external entity (XXE) vulnerability due to lxml	8 Jul 202609:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses lxml-6.0.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl which is vulnerable to CVE-2026-41066	1 Jun 202607:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in lxml bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging	13 Jul 202621:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in lxml (CVE-2026-41066)	31 May 202616:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for May 2026	12 Jun 202622:52	–	ibm
ATTACKERKB	CVE-2026-41066	24 Apr 202616:45	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : python3-lxml (ALAS2023-2026-1678)	20 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : python3.13-lxml (ALAS2023-2026-1679)	20 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-lxml, --advisory ALAS2-2026-3297 (ALAS-2026-3297)	14 May 202600:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-41066)	6 May 202600:00	–	nessus

NVD

Vulners

Node

lxml lxmlRange<6.1.0

[
  {
    "vendor": "lxml",
    "product": "lxml",
    "versions": [
      {
        "version": "< 6.1.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw
bugs	www.bugs.launchpad.net/lxml/+bug/2146291

17 Jun 2026 10:46Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.17.5

EPSS0.00324

SSVC

CWE-611