Loading vulnerability…
URL Sanitization Bypass and Stored XSS in lxml Cleaner
CVE-2026-49825 is a URL-sanitization bypass in the Python lxml and lxml_html_clean Cleaner functionality. In lxml versions before 6.1.1, lxml.html.defs.link_attrs omits the namespaced xlink:href attribute, allowing javascript: URLs in embedded SVG, MathML, and similar content to escape URL filtering. When Cleaner processes untrusted HTML with safe_attrs_only=False, these attributes can survive sanitization and subsequently cause stored cross-site scripting when a victim interacts with the rendered content. Fixes are available in lxml 6.1.1 and lxml_html_clean 0.4.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Applications relying on the affected Cleaner configuration can retain attacker-controlled executable URLs in supposedly sanitized HTML. Victim interaction with the resulting content can execute JavaScript in the application's browser origin, potentially exposing sensitive information accessible to that origin and enabling unauthorized actions under the victim's application permissions. The vulnerability assessment indicates high confidentiality impact, low integrity impact, and no availability impact.
If you can’t patch tonight, do this now.
Avoid processing untrusted HTML with Cleaner configured as safe_attrs_only=False; retain the default safe_attrs_only=True where possible. Alternatively, strip namespaced URL attributes such as xlink:href before rendering, or use a sanitizer that explicitly validates these URL-bearing attributes.
Patch, then assume compromise.
Upgrade lxml to version 6.1.1 or later and lxml_html_clean to version 0.4.5 or later, as applicable to the application's dependencies. For distribution-managed installations, install the vendor security update, which may backport the fix without adopting the upstream version number. Ensure applications using legacy lxml.html.clean interfaces also receive the corrected sanitizer implementation. If upgrading is temporarily impossible, patch URL sanitization to scrub xlink:href independently of link_attrs and handle equivalent namespaced URL-attribute representations.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.