https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T14:57:05.941075+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-41066 CVE-2026-41066 — lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files 2026-10-01T14:57:05.943251+00:00

Affected: lxml

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

 https://db.gcve.eu/vuln/ghsa-vfmq-68hx-4jfw GHSA-vfmq-68hx-4jfw — lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files 2026-10-01T14:57:05.943331+00:00

Affected: PyPI: lxml

### Impact Using either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.

### Patches lxml 6.1.0 changes the default to `resolve_entities='internal'`, thus disallowing local file access by default.

### Workarounds Setting the `resolve_entities` option explicitly to `resolve_entities='internal'` or `resolve_entities=False` disables the local file access.

### Resources Original report: https://bugs.launchpad.net/lxml/+bug/2146291

The default option was changed to `resolve_entities='internal'` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.

 https://db.gcve.eu/vuln/pysec-2026-87 PYSEC-2026-87 2026-10-01T14:57:05.943374+00:00

Affected: PyPI: lxml

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.