PT-2026-34232 · Pypi+1 · Lxml+1
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
lxml versions prior to 6.1.0
Description
Using the default configuration with the
resolve entities variable set to True allows untrusted XML input to read local files. This issue affects the iterparse() and ETCompatXMLParser() functions.Recommendations
Update to version 6.1.0.
As a temporary workaround, explicitly set the
resolve entities variable to internal or False to disable local file access.Exploit
Fix
DoS
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Os
Lxml