CVE-2026-41066

A flaw was found in lxml, a library for processing XML and HTML in Python. A remote attacker can exploit this vulnerability by sending untrusted XML input to an application using lxml's default parser configuration. This allows the attacker to read local files on the system, leading to information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications using the lxml library to process untrusted XML input should explicitly configure the parser to prevent external entity resolution. This can be achieved by setting the resolve_entities option to False or 'internal' when initializing the parser. For example, etree.XML(xml_input, parser=etree.XMLParser(resolve_entities=False)) or etree.HTML(html_input, parser=etree.HTMLParser(resolve_entities='internal')).