What is the CVSS score of CVE-2026-41066?

CVE-2026-41066 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of lxml are affected by CVE-2026-41066?

The lxml Python library (versions prior to 6.1.0) contains a vulnerability that allows remote attackers to read sensitive files from affected servers without authentication.. A patch is available.

How to fix or mitigate CVE-2026-41066?

Within 24 hours, inventory all systems and applications using lxml versions prior to 6.1.0, with particular attention to those processing external or untrusted XML documents. Within 7 days, upgrade lxml to version 6.1.0 or later across all affected systems; for systems where immediate upgrade is impractical, configure applications to disable external entity resolution. Verify and document completion of all upgrades by day 30.

lxml CVE-2026-41066

HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-04-21 https://github.com/lxml/lxml

GHSA-vfmq-68hx-4jfw

XXE

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote, unauthenticated, no interaction against the default parser config yields AV:N/AC:L/PR:N/UI:N; arbitrary local file read gives C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

5.9 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 05:39 vuln.today

Analysis Generated

Jul 24, 2026 - 05:39 vuln.today

Patch released

Apr 22, 2026 - 02:30 nvd

Patch available

CVE Published

Apr 21, 2026 - 20:38 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

42 pypi packages depend on lxml (40 direct, 2 indirect)

Ecosystem-wide dependent count for version 6.1.0.

DescriptionGitHub Advisory

Impact

Using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files.

Patches

lxml 6.1.0 changes the default to resolve_entities='internal', thus disallowing local file access by default.

Workarounds

Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access.

Resources

Original report: https://bugs.launchpad.net/lxml/+bug/2146291

The default option was changed to resolve_entities='internal' for the normal XML and HTML parsers in lxml 5.0. The default was not changed for iterparse() and ETCompatXMLParser() at the time. lxml 6.1 makes the safe option the default for all parsers.

AnalysisAI

Local file disclosure via XML External Entity (XXE) injection affects the lxml Python library (versions < 6.1.0) when applications parse untrusted XML using iterparse() or ETCompatXMLParser(), whose default configuration left resolve_entities=True. An unauthenticated remote attacker who can submit crafted XML to such an endpoint can read arbitrary local files readable by the process. There is no public exploit identified at time of analysis and EPSS risk is very low (0.03%), but exploitation is trivial (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) wherever these two specific parsers are used.

Technical ContextAI

lxml is a widely used Python binding to the libxml2/libxslt C libraries for XML and HTML processing. The root cause is CWE-611 (Improper Restriction of XML External Entity Reference): when a parser resolves external entities, an attacker-supplied DOCTYPE declaration can define an entity pointing at a local file path (e.g. file:///etc/passwd), and the parser substitutes the file contents into the document. lxml hardened its mainline XML and HTML parsers in 5.0 by switching the default to resolve_entities='internal', but two legacy entry points - the streaming iterparse() API and the ETCompatXMLParser() compatibility class - were overlooked and continued defaulting to resolve_entities=True. The affected component is the pip package lxml (CPE pkg:pip/lxml); the flaw is in the parser default configuration, not in libxml2 itself.

RemediationAI

Vendor-released patch: lxml 6.1.0 - upgrade to lxml >= 6.1.0, which changes the default to resolve_entities='internal' for all parsers including iterparse() and ETCompatXMLParser(), disabling local file access by default (release: https://github.com/lxml/lxml/releases/tag/lxml-6.1.0; advisory: https://github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw). If immediate upgrade is not possible, apply the vendor workaround in code by explicitly passing resolve_entities='internal' (preserves internal entity expansion) or resolve_entities=False (disables entity resolution entirely) to every iterparse() and ETCompatXMLParser() call that processes untrusted XML; the trade-off is that resolve_entities=False will break any legitimate document that depends on entity substitution, so validate that dependent XML still parses correctly. For distro-packaged installations (SUSE, Red Hat), apply the vendor backport once released rather than side-loading pip. As defense in depth, ensure the parsing process runs with least-privilege filesystem access so that even a successful XXE reads little of value.