CVE-2026-49825

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.link_attrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML), potentially leading to information disclosure or arbitrary code execution in the context of the user's browser.

This vulnerability is rated as an Important severity for Red Hat products because an unauthenticated remote attacker could inject malicious script schemes into rendered markup, resulting in cross-site scripting and potential session hijacking in the victim's browser. Exploitation requires an application to process untrusted user input using the HTML cleaner utility configured with non-default, relaxed attribute filtering. Under default library configurations where strict attribute allowlists are enforced, the relevant hyperlink attributes are stripped automatically before link scheme validation occurs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.