Critical URL Bypass Vulnerability in python3.12-lxml Package
Summary
RLSA-2026:66203: Important: python3.12-lxml security update. Affects python3.12-lxml versions < 0:4.9.3-2.el9_8.1. Fixed in 0:4.9.3-2.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3.12-lxml package is a powerful library for processing XML and HTML in Python. It provides a convenient API for creating and manipulating XML documents and is widely used for web scraping, data extraction, and document generation. However, the package has been found to have a security vulnerability that could allow attackers to bypass intended URL restrictions.
Vulnerability Detail
The vulnerability, identified as CVE-2026-49825, is a URL bypass issue in the lxml-html-clean module of the python3.12-lxml package. This flaw arises from a missing xlink:href attribute, which can be exploited by attackers to manipulate URLs and potentially access unauthorized resources. The ramifications of this vulnerability include unauthorized data exposure and the potential for further attacks on the system, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
0:4.9.3-2.el9_8.1
This is the first release that contains the fix.
sudo dnf update python3.12-lxmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected functionality or implement additional validation checks on URLs to mitigate the risk of exploitation until the package is updated.
Conclusion
The python3.12-lxml package has a critical vulnerability (CVE-2026-49825) that allows for URL bypass due to a missing xlink:href attribute. Users are strongly advised to update to the patched version to mitigate risks associated with unauthorized access and data exposure.
See every vulnerability recorded for python3.12-lxml →
FAQ
CVE-2026-49825 is a security vulnerability in the python3.12-lxml package that allows for URL bypass due to a missing xlink:href attribute.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to resources, data exposure, and further attacks on the system.
You can update the package by running the command 'sudo dnf update python3.12-lxml' in your terminal.
Yes, you can implement additional validation checks on URLs or restrict access to the affected functionality as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-lxml.
