USN-8897-1: lxml vulnerabilities
Ubuntu fixes lxml flaws that can bypass URL sanitization for XSS and leak local files via untrusted XML.
Canonical published USN-8897-1 for vulnerabilities in the lxml Python XML library. CVE-2026-49825, discovered by Guillem Lefait, can let a remote attacker bypass URL sanitization and trigger cross-site scripting. CVE-2026-41066, discovered by Qiu Sihao, can let a remote attacker read local files from untrusted XML; Ubuntu says that issue was fixed only on 24.04 LTS and 26.04 LTS. The notice does not report exploitation in the wild.
- CVE-2026-49825: crafted URL attributes can bypass sanitization and enable XSS.
- CVE-2026-41066: untrusted XML may allow local file reads and data exposure.
- The file-read fix applies only to Ubuntu 24.04 LTS and 26.04 LTS.
- The notice does not report active exploitation.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41066 | lxml is a library for processing XML and HTML in the Python language | 7.5 | <1% | PoC | |
| CVE-2026-49825 | lxml is a library for processing XML and HTML in the Python language | 8.2 | <1% |
From the original article
Guillem Lefait discovered that lxml incorrectly handled certain URL attributes. A remote attacker could possibly use this issue to bypass URL sanitization, leading to a cross-site scripting attack. (CVE-2026-49825) Qiu Sihao discovered that lxml incorrectly handled untrusted XML input.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.