Threats affecting pkg:pypi/lxml

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	–	EPSS 0.3%	CVE-2026-41066SUSE lxml · Security update for python-lxml MediumEPSS 0.3%2026-05-11GCVE DatabaseCVE-2026-41066 A vulnerability in the lxml library used by recon-ng allows XML External Entity (XXE) attacks via the default configuration of iterparse() and ETCompatXMLParser(). This enables untrusted XML input to read local files. The issue is addressed in lxml 6.1.0 by changing the default resolve_entities setting to 'internal', preventing local file access. Users can also mitigate by explicitly setting resolve_entities to 'internal' or false. EPSS 0.3%Vulnerability SUSE Product Security Team #brew-papis-cve-2026-41066 #homebrew #brew-gtk-doc-cve-2026-41066	GCVE Database	2026-05-11
Critical	9.1	EPSS 0.5%	CVE-2024-37388lxml · An XML External Entity (XXE) Critical9.1EPSS 0.5%2024-06-07CVE Database V5CVE-2024-37388 An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input. EPSS 0.5%Vulnerability CWE-611	CVE Database V5	2024-06-07

Page 1 of 1