This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-49825 →

UBUNTU-CVE-2026-49825

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``...

Original description

The description as published by the source.

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.link_attrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:Pro:14.04:LTS lxml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1ubuntu0.2+esm6"}]}]

Ubuntu:Pro:16.04:LTS lxml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1ubuntu0.4+esm3"}]}]

Ubuntu:Pro:18.04:LTS lxml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu0.6+esm1"}]}]

Ubuntu:Pro:20.04:LTS lxml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1ubuntu0.5+esm1"}]}]

Ubuntu:22.04:LTS lxml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0-1ubuntu0.1"}]}]

Ubuntu:24.04:LTS lxml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-1ubuntu0.2"}]}]

Ubuntu:26.04:LTS lxml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1ubuntu0.1"}]}]

References

advisory ubuntu.com
report ubuntu.com
report cve.org