Is lxml safe ? 7 known vulnerabilities, worst severity HIGH.
// reach 4 direct dependencies
2 carry known advisories, worst HIGH
533 packages depend on it
an advisory here reaches each of them
// ai model usage No published models are known to use this package.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 26th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-vfmq-68hx-4jfw, the advisory selected below
// 7 advisories GHSA-vfmq-68hx-4jfw Using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. HIGH GHSA-wrxv-2j5q-m38w NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the MODE GHSA-57qw-cc2g-pv5p Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function. MODE GHSA-xp26-p53h-6h2p An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146. MODE GHSA-55x5-fj6c-h6m8 The HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. MODE GHSA-jq4v-f5q6-mjqq An XSS vulnerability was discovered in the python lxml clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4 MODE GHSA-pgww-xf46-h92r A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code. MODE // impact Using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files.
// patches lxml 6.1.0 changes the default to resolve_entities='internal', thus disallowing local file access by default.
// workarounds Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access.
// resources Original report: https://bugs.launchpad.net/lxml/+bug/2146291
The default option was changed to resolve_entities='internal' for the normal XML and HTML parsers in lxml 5.0. The default was not changed for iterparse() and ETCompatXMLParser() at the time. lxml 6.1 makes the safe option the default for all parsers.
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None Checked 2026-11-06 at 22:34 UTC. The most recent advisory here was published 2026-04-21. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page