lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

🗓️ 21 Apr 2026 20:38:44Reported by GitHub Advisory DatabaseType

Default iterparse and ETCompatXMLParser allowed local file access; lxml 6.1.0 makes it safe.

Reporter	Title	Published	Views	Family All 60
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses lxml-6.0.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl which is vulnerable to CVE-2026-41066	1 Jun 202607:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in lxml (CVE-2026-41066)	31 May 202616:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for May 2026	29 May 202610:53	–	ibm
ATTACKERKB	CVE-2026-41066	24 Apr 202616:45	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : python3-lxml (ALAS2023-2026-1678)	20 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : python3.13-lxml (ALAS2023-2026-1679)	20 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-lxml, --advisory ALAS2-2026-3297 (ALAS-2026-3297)	14 May 202600:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-41066)	6 May 202600:00	–	nessus
Tenable Nessus	SUSE SLES16 Security Update : python-lxml (SUSE-SU-2026:21603-1)	16 May 202600:00	–	nessus
Tenable Nessus	TencentOS Server 4: python-lxml (TSSA-2026:0288)	14 May 202600:00	–	nessus

Vulners

Node

lxml lxmlRange<6.1.0pip

Source	Link
github	www.github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw
bugs	www.bugs.launchpad.net/lxml/+bug/2146291
github	www.github.com/lxml/lxml/releases/tag/lxml-6.1.0
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41066
github	www.github.com/advisories/GHSA-vfmq-68hx-4jfw

27 Apr 2026 16:43Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00044

SSVC