Critical Security Update for python3.12-lxml: URL Bypass Vulnerability
Summary
ALSA-2026:66203: Important: python3.12-lxml security update. Affects python3.12-lxml versions < 4.9.3-2.el9_8.1. Fixed in 4.9.3-2.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. The python3.12-lxml package is an essential library that provides a powerful and flexible way to process XML and HTML in Python. It includes features for parsing, creating, and modifying XML and HTML documents. However, this package has been identified to have a security vulnerability that could potentially allow unauthorized access to URLs, compromising the integrity of applications relying on it.
Vulnerability Detail
The vulnerability identified as CVE-2026-49825 is a URL bypass issue within the lxml-html-clean module of the python3.12-lxml package. This flaw arises from a missing xlink:href attribute in the Cleaner component, which can be exploited to bypass security measures, leading to unauthorized access to sensitive URLs. The ramifications of this vulnerability could include data leakage, unauthorized data manipulation, and a breach of application security, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
4.9.3-2.el9_8.1
This is the first release that contains the fix.
sudo dnf update python3.12-lxmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider disabling the affected features of the lxml-html-clean module until the package can be updated. However, it is highly recommended to apply the patch as soon as possible to ensure full protection against the vulnerability.
Conclusion
The python3.12-lxml package has a critical vulnerability (CVE-2026-49825) that needs immediate attention. Users are advised to update to the patched version to safeguard their applications against potential security breaches. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.12-lxml →
FAQ
CVE-2026-49825 is a security vulnerability in the python3.12-lxml package that allows URL bypass due to a missing xlink:href attribute.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive URLs, potential data leakage, and compromise of application security.
Yes, the patched version of the python3.12-lxml package is 4.9.3-2.el9_8.1, which addresses the vulnerability.
If immediate updates are not possible, consider disabling the affected features of the lxml-html-clean module as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-lxml.
