https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 14:54:55 +0000 https://db.gcve.eu/vuln/cve-2026-41066 <p><strong>Affected:</strong> lxml</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&#39;internal&#39; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.</p> <p><strong>Affected:</strong> lxml</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&#39;internal&#39; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.</p> https://db.gcve.eu/vuln/cve-2026-41066 https://db.gcve.eu/vuln/ghsa-vfmq-68hx-4jfw <p><strong>Affected:</strong> PyPI: lxml</p> <p>### Impact Using either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.</p> <p>### Patches lxml 6.1.0 changes the default to `resolve_entities=&#39;internal&#39;`, thus disallowing local file access by default.</p> <p>### Workarounds Setting the `resolve_entities` option explicitly to `resolve_entities=&#39;internal&#39;` or `resolve_entities=False` disables the local file access.</p> <p>### Resources Original report: https://bugs.launchpad.net/lxml/+bug/2146291</p> <p>The default option was changed to `resolve_entities=&#39;internal&#39;` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.</p> <p><strong>Affected:</strong> PyPI: lxml</p> <p>### Impact Using either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.</p> <p>### Patches lxml 6.1.0 changes the default to `resolve_entities=&#39;internal&#39;`, thus disallowing local file access by default.</p> <p>### Workarounds Setting the `resolve_entities` option explicitly to `resolve_entities=&#39;internal&#39;` or `resolve_entities=False` disables the local file access.</p> <p>### Resources Original report: https://bugs.launchpad.net/lxml/+bug/2146291</p> <p>The default option was changed to `resolve_entities=&#39;internal&#39;` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.</p> https://db.gcve.eu/vuln/ghsa-vfmq-68hx-4jfw https://db.gcve.eu/vuln/pysec-2026-87 <p><strong>Affected:</strong> PyPI: lxml</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&#39;internal&#39; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.</p> <p><strong>Affected:</strong> PyPI: lxml</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&#39;internal&#39; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.</p> https://db.gcve.eu/vuln/pysec-2026-87