{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3.12-lxml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.9.3-2.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href (CVE-2026-49825)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:66203",
  "modified": "2026-09-10T09:13:44Z",
  "published": "2026-09-09T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:66203"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-49825"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2520368"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-66203.html"
    }
  ],
  "related": [
    "CVE-2026-49825"
  ],
  "summary": "Important: python3.12-lxml security update"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "python3-lxml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.5-3.el9_8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href (CVE-2026-49825)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:66204",
  "modified": "2026-09-10T09:13:43Z",
  "published": "2026-09-09T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:66204"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-49825"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2520368"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-66204.html"
    }
  ],
  "related": [
    "CVE-2026-49825"
  ],
  "summary": "Important: python-lxml security update"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3-lxml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.3-5.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href (CVE-2026-49825)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:67943",
  "modified": "2026-09-16T13:25:38Z",
  "published": "2026-09-16T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:67943"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-49825"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2520368"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-67943.html"
    }
  ],
  "related": [
    "CVE-2026-49825"
  ],
  "summary": "Important: python-lxml security update"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpaquita:23",
        "name": "py3-lxml",
        "purl": "pkg:apk/alpaquita/py3-lxml?arch=source\u0026distro=23"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.9.1-r1"
            },
            {
              "fixed": "4.9.3-r3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:25",
        "name": "py3-lxml",
        "purl": "pkg:apk/alpaquita/py3-lxml?arch=source\u0026distro=25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3.1-r0"
            },
            {
              "fixed": "5.3.1-r2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:stream",
        "name": "py3-lxml",
        "purl": "pkg:apk/alpaquita/py3-lxml?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.9.1-r1"
            },
            {
              "fixed": "6.1.1-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "id": "BELL-CVE-2026-49825",
  "modified": "2026-09-03T11:26:25.724785Z",
  "published": "2026-08-22T06:05:48.34275Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://docs.bell-sw.com/security/cves/CVE-2026-49825"
    }
  ],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-49825"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "lxml-html-clean",
        "resource_purl": "pkg:pypi/lxml-html-clean@0.4.5",
        "upstream_fixed_in": "0.4.5"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "gptline",
        "purl": "pkg:brew/gptline"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.8_22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/lxml-html-clean@0.4.5",
        "name": "lxml-html-clean",
        "resource": "lxml-html-clean",
        "strategy": "registry",
        "subject_version": "0.4.5"
      }
    ]
  },
  "details": "# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`)\n\n**Reporter:** Guillem Lefait \u003cguillem@datamq.com\u003e \u00b7 **Date:** 2026-05-10\n**Affected:** `lxml` \u2264 6.1.0 and `lxml_html_clean` \u2264 0.4.4 (latest stable)\n**Confirmed against:** lxml 6.1.0 + lxml_html_clean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 (libxml2 2.14.6 / 2.9.14 \u2014 bug is in pure-Python sanitizer logic, independent of the libxml2 backend)\n**Root-cause class:** same as CVE-2021-28957 (`formaction` missing from `link_attrs`)\n\n## Summary\n\n`Cleaner` filters URL schemes (`javascript:`, `vbscript:`, \u2026) by walking links via `rewrite_links()`, which delegates to `iterlinks()`, which only yields attributes named in `lxml.html.defs.link_attrs`. That allow-list contains no prefixed names (`xlink:href`) and no `srcset`. As a result, when `Cleaner` is configured with `safe_attrs_only=False` \u2014 a documented option for callers that want lenient attribute handling but still expect URL-scheme scrubbing \u2014 `\u003ca xlink:href=\"javascript:\u2026\"\u003e` survives sanitization untouched, and any browser that follows the SVG-anchor specification will execute the JavaScript when the rendered link is clicked.\n\n**CWE:** CWE-79 (XSS), with CWE-184 (Incomplete List of Disallowed Inputs) as the underlying defect class.\n\n## Affected components\n\n| Package            | Versions tested        | File / line                      |\n|--------------------|------------------------|----------------------------------|\n| `lxml`             | 4.9.x, 5.2.1, 6.1.0    | `src/lxml/html/defs.py:20`       |\n| `lxml`             | \"                      | `src/lxml/html/__init__.py:485-528` |\n| `lxml_html_clean`  | 0.4.0 \u2013 0.4.4          | `lxml_html_clean/clean.py:348,576` |\n\nThe legacy `lxml.html.clean` module \u2014 bundled in `lxml \u003c 5.2.0` and still installable on newer versions via the `lxml[html_clean]` extra \u2014 shares the same bug.\n\n## Root cause\n\n`defs.link_attrs` is a flat string set; the literal `xlink:href` is absent:\n\n```python\n# lxml/html/defs.py\nlink_attrs = frozenset([\n    \u0027action\u0027, \u0027archive\u0027, \u0027background\u0027, \u0027cite\u0027, \u0027classid\u0027,\n    \u0027codebase\u0027, \u0027data\u0027, \u0027href\u0027, \u0027longdesc\u0027, \u0027profile\u0027, \u0027src\u0027,\n    \u0027usemap\u0027, \u0027dynsrc\u0027, \u0027lowsrc\u0027, \u0027formaction\u0027,\n])\n```\n\n`HtmlMixin.iterlinks()` (`lxml/html/__init__.py:526-528`) only yields attributes whose key is in that set:\n\n```python\nfor attrib in link_attrs:\n    if attrib in attribs:\n        yield (el, attrib, attribs[attrib], 0)\n```\n\n`Cleaner.__call__` registers the URL-scheme filter via `rewrite_links` (`lxml_html_clean/clean.py:348`), which is a thin wrapper around `iterlinks()`. Because `xlink:href` is never yielded, `_remove_javascript_link` (`clean.py:576`) is never invoked for it.\n\n## Minimal reproducer\n\n```python\nfrom lxml import html\nfrom lxml_html_clean import Cleaner\n\nfor payload in (\n    \u0027\u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e\u0027,\n    \u0027\u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e\u0027,\n):\n    tree = html.fromstring(payload)\n    Cleaner(safe_attrs_only=False)(tree)\n    print(html.tostring(tree).decode())\n    print(\u0027  iterlinks:\u0027, list(html.fromstring(payload).iterlinks()))\n# \u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e     \u2190 unchanged\n#   iterlinks: []                                          \u2190 link rewriter blind\n# \u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e   \u2190 unchanged\n#   iterlinks: []                                          \u2190 link rewriter blind\n```\n\nBoth SVG and MathML scopes are vulnerable \u2014 same allow-list gap, both render anchors that browsers treat as navigable. Other lab-confirmed surviving variants (same scope, different scheme encoding): mixed-case (`JaVaScRiPt:`), HTML-entity (`java\u0026#x73;cript:`), embedded tab (`java\\tscript:`).\n\n## Impact\n\nA caller that uses `Cleaner` to neutralise untrusted HTML and chooses `safe_attrs_only=False` \u2014 typically because the application wants to allow custom data-/aria-/vendor attributes \u2014 will silently pass `javascript:` payloads carried on `xlink:href` through to victim renders. Stored XSS in any application that round-trips user-supplied HTML through this configuration. Reach is conditional on the `safe_attrs_only=False` toggle, but that is a documented public option; consumers reasonably expect URL-scheme scrubbing to be independent of attribute allow-listing.\n\n## Suggested fix\n\n**Extend `link_attrs`** to include `xlink:href`. In HTML mode, `lxml.html` keeps prefixed attribute names verbatim \u2014 the parsed key is the literal string `xlink:href`, not a Clark-notation form \u2014 so the existing allow-list lookup is a plain string match. Same shape as the CVE-2021-28957 fix:\n\n```diff\n # lxml/html/defs.py\n link_attrs = frozenset([\n     \u0027action\u0027, \u0027archive\u0027, \u0027background\u0027, \u0027cite\u0027, \u0027classid\u0027,\n     \u0027codebase\u0027, \u0027data\u0027, \u0027href\u0027, \u0027longdesc\u0027, \u0027profile\u0027, \u0027src\u0027,\n     \u0027usemap\u0027, \u0027dynsrc\u0027, \u0027lowsrc\u0027, \u0027formaction\u0027,\n+    \u0027xlink:href\u0027,\n ])\n```\n\nThis single change closes the reported XSS for both SVG `\u003ca xlink:href\u003e` and MathML `\u003ca xlink:href\u003e`. `lxml_html_clean` is the canonical home of the `Cleaner` code (881 lines); `lxml.html.clean` is a 21-line backward-compat shim (`from lxml_html_clean import *`) that picks up the fix automatically once `link_attrs` is updated upstream. Since the upstream change requires lxml maintainer action, see the alternative below if a self-contained patch in `lxml_html_clean` is preferred.\n\n**Alternative (in-package fix, no lxml coordination needed):** add a namespaced-URL-attribute walk inside `Cleaner.__call__` so the URL-scheme filter doesn\u0027t depend on `link_attrs`. Sketch:\n\n```python\n# lxml_html_clean/clean.py \u2014 supplements rewrite_links() in __call__\n_NS_URL_ATTRS = (\u0027xlink:href\u0027,)  # extend as needed\n_BAD_SCHEME = re.compile(r\u0027^\\s*(javascript|vbscript|data):\u0027, re.I)\n\nfor el in doc.iter():\n    for attr in _NS_URL_ATTRS:\n        if attr in el.attrib and _BAD_SCHEME.match(el.attrib[attr]):\n            del el.attrib[attr]\n```\n\nThis decouples the cleaner from the upstream `link_attrs` set and matches the security-ownership boundary established when the cleaner was extracted in lxml 5.2.0.\n\n**Defense in depth (optional, regardless of which fix path is taken):**\n- Also handle `srcset`: the value is a `url 1x, url 2x, \u2026` descriptor list, so split on commas and validate each candidate URL. Not directly executable in current browsers, but closes the same gap.\n- Also accept Clark-notation forms (`{http://www.w3.org/1999/xlink}href`) so XML-mode callers using `lxml.etree` get the same protection. HTML mode never produces this form, so not needed for the reported bug.\n\n## Severity\n\nCVSS 3.1 base score: **8.2 / High** \u2014 `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N` (stored XSS; victim must click the SVG anchor; scope-changed because script executes in the rendering origin). PR:N reflects the common case where untrusted HTML enters the sanitizer from anonymous sources (comments, support tickets); deployments that gate writes behind authentication can score with PR:L (\u2192 7.6).\n\nSeverity is **CONDITIONAL** on the caller passing `safe_attrs_only=False`. With the class default (`True`), attribute allow-listing strips `xlink:href` before scheme scrubbing runs, and the bug does not fire \u2014 verified at HEAD: default-config `Cleaner()(\u003csvg\u003e\u003ca xlink:href=\"javascript:\u2026\"\u003ex\u003c/a\u003e\u003c/svg\u003e)` \u2192 `\u003csvg\u003e\u003ca\u003ex\u003c/a\u003e\u003c/svg\u003e`.\n\n## Prior art / novelty\n\n- **CVE-2021-28957 (lxml 4.6.3)** \u2014 same root cause, different attribute (`formaction`). Fix was a one-line extension of `link_attrs`. Direct precedent.\n- **CVE-2022-34473** (Mozilla Sanitizer API) \u2014 `xlink:href` URL bypass primitive in a different sanitizer.\n- **Bleach (Mozilla, Python)** explicitly handles the `xlink` namespace; `enshrined/svg-sanitize` (PHP) ships `cleanXlinkHrefs()`; DOMPurify scrubs `xlink:href` via `ALLOWED_URI_REGEXP`.\n- **`nh3`** (the alternative recommended in `lxml_html_clean`\u0027s own README for security-sensitive use) is **not vulnerable** to this primitive \u2014 verified 2026-05-10 on `nh3==0.3.5`: with `\u003csvg\u003e`/`\u003cmath\u003e`/`\u003ca\u003e` and `xlink:href` explicitly added to `tags`/`attributes`, both SVG and MathML payloads, all four scheme-encoding variants, are stripped (output e.g. `\u003csvg\u003e\u003ca rel=\"noopener noreferrer\"\u003ex\u003c/a\u003e\u003c/svg\u003e`).\n\n\n## Coordination\n\nFiling as a private GHSA at `fedora-python/lxml_html_clean` \u2014 `lxml_html_clean` is the canonical maintainer of the `Cleaner` code (881 lines) and the security-responsible team since the lxml 5.2.0 split, where the cleaner was extracted out of lxml precisely so cleaner-security reports could land on the right team. The lxml side cannot be filed via GHSA (`https://github.com/lxml/lxml/security/advisories/new` returns 404 \u2014 private reporting is not enabled), so a parallel report has been emailed directly to the lxml maintainer for the upstream `defs.link_attrs` patch path. You\u0027re welcome to coordinate with them directly if you\u0027d prefer the upstream fix over the in-package alternative above.\n\nHappy to provide a draft patch or PR on either path. No bounty expected.",
  "id": "BREW-gptline-CVE-2026-49825",
  "modified": "2026-09-10T00:05:56Z",
  "published": "2026-08-13T16:54:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fedora-python/lxml_html_clean"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes",
  "upstream": [
    "GHSA-4jhm-jv67-739f",
    "CVE-2026-49825",
    "PYSEC-2026-2614"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "lxml-html-clean",
        "resource_purl": "pkg:pypi/lxml-html-clean@0.4.4",
        "upstream_fixed_in": "0.4.5"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "kimi-cli",
        "purl": "pkg:brew/kimi-cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/lxml-html-clean@0.4.4",
        "name": "lxml-html-clean",
        "resource": "lxml-html-clean",
        "strategy": "registry",
        "subject_version": "0.4.4"
      }
    ]
  },
  "details": "# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`)\n\n**Reporter:** Guillem Lefait \u003cguillem@datamq.com\u003e \u00b7 **Date:** 2026-05-10\n**Affected:** `lxml` \u2264 6.1.0 and `lxml_html_clean` \u2264 0.4.4 (latest stable)\n**Confirmed against:** lxml 6.1.0 + lxml_html_clean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 (libxml2 2.14.6 / 2.9.14 \u2014 bug is in pure-Python sanitizer logic, independent of the libxml2 backend)\n**Root-cause class:** same as CVE-2021-28957 (`formaction` missing from `link_attrs`)\n\n## Summary\n\n`Cleaner` filters URL schemes (`javascript:`, `vbscript:`, \u2026) by walking links via `rewrite_links()`, which delegates to `iterlinks()`, which only yields attributes named in `lxml.html.defs.link_attrs`. That allow-list contains no prefixed names (`xlink:href`) and no `srcset`. As a result, when `Cleaner` is configured with `safe_attrs_only=False` \u2014 a documented option for callers that want lenient attribute handling but still expect URL-scheme scrubbing \u2014 `\u003ca xlink:href=\"javascript:\u2026\"\u003e` survives sanitization untouched, and any browser that follows the SVG-anchor specification will execute the JavaScript when the rendered link is clicked.\n\n**CWE:** CWE-79 (XSS), with CWE-184 (Incomplete List of Disallowed Inputs) as the underlying defect class.\n\n## Affected components\n\n| Package            | Versions tested        | File / line                      |\n|--------------------|------------------------|----------------------------------|\n| `lxml`             | 4.9.x, 5.2.1, 6.1.0    | `src/lxml/html/defs.py:20`       |\n| `lxml`             | \"                      | `src/lxml/html/__init__.py:485-528` |\n| `lxml_html_clean`  | 0.4.0 \u2013 0.4.4          | `lxml_html_clean/clean.py:348,576` |\n\nThe legacy `lxml.html.clean` module \u2014 bundled in `lxml \u003c 5.2.0` and still installable on newer versions via the `lxml[html_clean]` extra \u2014 shares the same bug.\n\n## Root cause\n\n`defs.link_attrs` is a flat string set; the literal `xlink:href` is absent:\n\n```python\n# lxml/html/defs.py\nlink_attrs = frozenset([\n    \u0027action\u0027, \u0027archive\u0027, \u0027background\u0027, \u0027cite\u0027, \u0027classid\u0027,\n    \u0027codebase\u0027, \u0027data\u0027, \u0027href\u0027, \u0027longdesc\u0027, \u0027profile\u0027, \u0027src\u0027,\n    \u0027usemap\u0027, \u0027dynsrc\u0027, \u0027lowsrc\u0027, \u0027formaction\u0027,\n])\n```\n\n`HtmlMixin.iterlinks()` (`lxml/html/__init__.py:526-528`) only yields attributes whose key is in that set:\n\n```python\nfor attrib in link_attrs:\n    if attrib in attribs:\n        yield (el, attrib, attribs[attrib], 0)\n```\n\n`Cleaner.__call__` registers the URL-scheme filter via `rewrite_links` (`lxml_html_clean/clean.py:348`), which is a thin wrapper around `iterlinks()`. Because `xlink:href` is never yielded, `_remove_javascript_link` (`clean.py:576`) is never invoked for it.\n\n## Minimal reproducer\n\n```python\nfrom lxml import html\nfrom lxml_html_clean import Cleaner\n\nfor payload in (\n    \u0027\u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e\u0027,\n    \u0027\u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e\u0027,\n):\n    tree = html.fromstring(payload)\n    Cleaner(safe_attrs_only=False)(tree)\n    print(html.tostring(tree).decode())\n    print(\u0027  iterlinks:\u0027, list(html.fromstring(payload).iterlinks()))\n# \u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e     \u2190 unchanged\n#   iterlinks: []                                          \u2190 link rewriter blind\n# \u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e   \u2190 unchanged\n#   iterlinks: []                                          \u2190 link rewriter blind\n```\n\nBoth SVG and MathML scopes are vulnerable \u2014 same allow-list gap, both render anchors that browsers treat as navigable. Other lab-confirmed surviving variants (same scope, different scheme encoding): mixed-case (`JaVaScRiPt:`), HTML-entity (`java\u0026#x73;cript:`), embedded tab (`java\\tscript:`).\n\n## Impact\n\nA caller that uses `Cleaner` to neutralise untrusted HTML and chooses `safe_attrs_only=False` \u2014 typically because the application wants to allow custom data-/aria-/vendor attributes \u2014 will silently pass `javascript:` payloads carried on `xlink:href` through to victim renders. Stored XSS in any application that round-trips user-supplied HTML through this configuration. Reach is conditional on the `safe_attrs_only=False` toggle, but that is a documented public option; consumers reasonably expect URL-scheme scrubbing to be independent of attribute allow-listing.\n\n## Suggested fix\n\n**Extend `link_attrs`** to include `xlink:href`. In HTML mode, `lxml.html` keeps prefixed attribute names verbatim \u2014 the parsed key is the literal string `xlink:href`, not a Clark-notation form \u2014 so the existing allow-list lookup is a plain string match. Same shape as the CVE-2021-28957 fix:\n\n```diff\n # lxml/html/defs.py\n link_attrs = frozenset([\n     \u0027action\u0027, \u0027archive\u0027, \u0027background\u0027, \u0027cite\u0027, \u0027classid\u0027,\n     \u0027codebase\u0027, \u0027data\u0027, \u0027href\u0027, \u0027longdesc\u0027, \u0027profile\u0027, \u0027src\u0027,\n     \u0027usemap\u0027, \u0027dynsrc\u0027, \u0027lowsrc\u0027, \u0027formaction\u0027,\n+    \u0027xlink:href\u0027,\n ])\n```\n\nThis single change closes the reported XSS for both SVG `\u003ca xlink:href\u003e` and MathML `\u003ca xlink:href\u003e`. `lxml_html_clean` is the canonical home of the `Cleaner` code (881 lines); `lxml.html.clean` is a 21-line backward-compat shim (`from lxml_html_clean import *`) that picks up the fix automatically once `link_attrs` is updated upstream. Since the upstream change requires lxml maintainer action, see the alternative below if a self-contained patch in `lxml_html_clean` is preferred.\n\n**Alternative (in-package fix, no lxml coordination needed):** add a namespaced-URL-attribute walk inside `Cleaner.__call__` so the URL-scheme filter doesn\u0027t depend on `link_attrs`. Sketch:\n\n```python\n# lxml_html_clean/clean.py \u2014 supplements rewrite_links() in __call__\n_NS_URL_ATTRS = (\u0027xlink:href\u0027,)  # extend as needed\n_BAD_SCHEME = re.compile(r\u0027^\\s*(javascript|vbscript|data):\u0027, re.I)\n\nfor el in doc.iter():\n    for attr in _NS_URL_ATTRS:\n        if attr in el.attrib and _BAD_SCHEME.match(el.attrib[attr]):\n            del el.attrib[attr]\n```\n\nThis decouples the cleaner from the upstream `link_attrs` set and matches the security-ownership boundary established when the cleaner was extracted in lxml 5.2.0.\n\n**Defense in depth (optional, regardless of which fix path is taken):**\n- Also handle `srcset`: the value is a `url 1x, url 2x, \u2026` descriptor list, so split on commas and validate each candidate URL. Not directly executable in current browsers, but closes the same gap.\n- Also accept Clark-notation forms (`{http://www.w3.org/1999/xlink}href`) so XML-mode callers using `lxml.etree` get the same protection. HTML mode never produces this form, so not needed for the reported bug.\n\n## Severity\n\nCVSS 3.1 base score: **8.2 / High** \u2014 `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N` (stored XSS; victim must click the SVG anchor; scope-changed because script executes in the rendering origin). PR:N reflects the common case where untrusted HTML enters the sanitizer from anonymous sources (comments, support tickets); deployments that gate writes behind authentication can score with PR:L (\u2192 7.6).\n\nSeverity is **CONDITIONAL** on the caller passing `safe_attrs_only=False`. With the class default (`True`), attribute allow-listing strips `xlink:href` before scheme scrubbing runs, and the bug does not fire \u2014 verified at HEAD: default-config `Cleaner()(\u003csvg\u003e\u003ca xlink:href=\"javascript:\u2026\"\u003ex\u003c/a\u003e\u003c/svg\u003e)` \u2192 `\u003csvg\u003e\u003ca\u003ex\u003c/a\u003e\u003c/svg\u003e`.\n\n## Prior art / novelty\n\n- **CVE-2021-28957 (lxml 4.6.3)** \u2014 same root cause, different attribute (`formaction`). Fix was a one-line extension of `link_attrs`. Direct precedent.\n- **CVE-2022-34473** (Mozilla Sanitizer API) \u2014 `xlink:href` URL bypass primitive in a different sanitizer.\n- **Bleach (Mozilla, Python)** explicitly handles the `xlink` namespace; `enshrined/svg-sanitize` (PHP) ships `cleanXlinkHrefs()`; DOMPurify scrubs `xlink:href` via `ALLOWED_URI_REGEXP`.\n- **`nh3`** (the alternative recommended in `lxml_html_clean`\u0027s own README for security-sensitive use) is **not vulnerable** to this primitive \u2014 verified 2026-05-10 on `nh3==0.3.5`: with `\u003csvg\u003e`/`\u003cmath\u003e`/`\u003ca\u003e` and `xlink:href` explicitly added to `tags`/`attributes`, both SVG and MathML payloads, all four scheme-encoding variants, are stripped (output e.g. `\u003csvg\u003e\u003ca rel=\"noopener noreferrer\"\u003ex\u003c/a\u003e\u003c/svg\u003e`).\n\n\n## Coordination\n\nFiling as a private GHSA at `fedora-python/lxml_html_clean` \u2014 `lxml_html_clean` is the canonical maintainer of the `Cleaner` code (881 lines) and the security-responsible team since the lxml 5.2.0 split, where the cleaner was extracted out of lxml precisely so cleaner-security reports could land on the right team. The lxml side cannot be filed via GHSA (`https://github.com/lxml/lxml/security/advisories/new` returns 404 \u2014 private reporting is not enabled), so a parallel report has been emailed directly to the lxml maintainer for the upstream `defs.link_attrs` patch path. You\u0027re welcome to coordinate with them directly if you\u0027d prefer the upstream fix over the in-package alternative above.\n\nHappy to provide a draft patch or PR on either path. No bounty expected.",
  "id": "BREW-kimi-cli-CVE-2026-49825",
  "modified": "2026-09-10T00:17:52Z",
  "published": "2026-08-13T17:01:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fedora-python/lxml_html_clean"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes",
  "upstream": [
    "GHSA-4jhm-jv67-739f",
    "CVE-2026-49825",
    "PYSEC-2026-2614"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "lxml-html-clean",
        "resource_purl": "pkg:pypi/lxml-html-clean@0.4.5",
        "upstream_fixed_in": "0.4.5"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "trafilatura",
        "purl": "pkg:brew/trafilatura"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10.0"
            },
            {
              "fixed": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/lxml-html-clean@0.4.5",
        "name": "lxml-html-clean",
        "resource": "lxml-html-clean",
        "strategy": "registry",
        "subject_version": "0.4.5"
      }
    ]
  },
  "details": "# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`)\n\n**Reporter:** Guillem Lefait \u003cguillem@datamq.com\u003e \u00b7 **Date:** 2026-05-10\n**Affected:** `lxml` \u2264 6.1.0 and `lxml_html_clean` \u2264 0.4.4 (latest stable)\n**Confirmed against:** lxml 6.1.0 + lxml_html_clean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 (libxml2 2.14.6 / 2.9.14 \u2014 bug is in pure-Python sanitizer logic, independent of the libxml2 backend)\n**Root-cause class:** same as CVE-2021-28957 (`formaction` missing from `link_attrs`)\n\n## Summary\n\n`Cleaner` filters URL schemes (`javascript:`, `vbscript:`, \u2026) by walking links via `rewrite_links()`, which delegates to `iterlinks()`, which only yields attributes named in `lxml.html.defs.link_attrs`. That allow-list contains no prefixed names (`xlink:href`) and no `srcset`. As a result, when `Cleaner` is configured with `safe_attrs_only=False` \u2014 a documented option for callers that want lenient attribute handling but still expect URL-scheme scrubbing \u2014 `\u003ca xlink:href=\"javascript:\u2026\"\u003e` survives sanitization untouched, and any browser that follows the SVG-anchor specification will execute the JavaScript when the rendered link is clicked.\n\n**CWE:** CWE-79 (XSS), with CWE-184 (Incomplete List of Disallowed Inputs) as the underlying defect class.\n\n## Affected components\n\n| Package            | Versions tested        | File / line                      |\n|--------------------|------------------------|----------------------------------|\n| `lxml`             | 4.9.x, 5.2.1, 6.1.0    | `src/lxml/html/defs.py:20`       |\n| `lxml`             | \"                      | `src/lxml/html/__init__.py:485-528` |\n| `lxml_html_clean`  | 0.4.0 \u2013 0.4.4          | `lxml_html_clean/clean.py:348,576` |\n\nThe legacy `lxml.html.clean` module \u2014 bundled in `lxml \u003c 5.2.0` and still installable on newer versions via the `lxml[html_clean]` extra \u2014 shares the same bug.\n\n## Root cause\n\n`defs.link_attrs` is a flat string set; the literal `xlink:href` is absent:\n\n```python\n# lxml/html/defs.py\nlink_attrs = frozenset([\n    \u0027action\u0027, \u0027archive\u0027, \u0027background\u0027, \u0027cite\u0027, \u0027classid\u0027,\n    \u0027codebase\u0027, \u0027data\u0027, \u0027href\u0027, \u0027longdesc\u0027, \u0027profile\u0027, \u0027src\u0027,\n    \u0027usemap\u0027, \u0027dynsrc\u0027, \u0027lowsrc\u0027, \u0027formaction\u0027,\n])\n```\n\n`HtmlMixin.iterlinks()` (`lxml/html/__init__.py:526-528`) only yields attributes whose key is in that set:\n\n```python\nfor attrib in link_attrs:\n    if attrib in attribs:\n        yield (el, attrib, attribs[attrib], 0)\n```\n\n`Cleaner.__call__` registers the URL-scheme filter via `rewrite_links` (`lxml_html_clean/clean.py:348`), which is a thin wrapper around `iterlinks()`. Because `xlink:href` is never yielded, `_remove_javascript_link` (`clean.py:576`) is never invoked for it.\n\n## Minimal reproducer\n\n```python\nfrom lxml import html\nfrom lxml_html_clean import Cleaner\n\nfor payload in (\n    \u0027\u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e\u0027,\n    \u0027\u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e\u0027,\n):\n    tree = html.fromstring(payload)\n    Cleaner(safe_attrs_only=False)(tree)\n    print(html.tostring(tree).decode())\n    print(\u0027  iterlinks:\u0027, list(html.fromstring(payload).iterlinks()))\n# \u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e     \u2190 unchanged\n#   iterlinks: []                                          \u2190 link rewriter blind\n# \u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e   \u2190 unchanged\n#   iterlinks: []                                          \u2190 link rewriter blind\n```\n\nBoth SVG and MathML scopes are vulnerable \u2014 same allow-list gap, both render anchors that browsers treat as navigable. Other lab-confirmed surviving variants (same scope, different scheme encoding): mixed-case (`JaVaScRiPt:`), HTML-entity (`java\u0026#x73;cript:`), embedded tab (`java\\tscript:`).\n\n## Impact\n\nA caller that uses `Cleaner` to neutralise untrusted HTML and chooses `safe_attrs_only=False` \u2014 typically because the application wants to allow custom data-/aria-/vendor attributes \u2014 will silently pass `javascript:` payloads carried on `xlink:href` through to victim renders. Stored XSS in any application that round-trips user-supplied HTML through this configuration. Reach is conditional on the `safe_attrs_only=False` toggle, but that is a documented public option; consumers reasonably expect URL-scheme scrubbing to be independent of attribute allow-listing.\n\n## Suggested fix\n\n**Extend `link_attrs`** to include `xlink:href`. In HTML mode, `lxml.html` keeps prefixed attribute names verbatim \u2014 the parsed key is the literal string `xlink:href`, not a Clark-notation form \u2014 so the existing allow-list lookup is a plain string match. Same shape as the CVE-2021-28957 fix:\n\n```diff\n # lxml/html/defs.py\n link_attrs = frozenset([\n     \u0027action\u0027, \u0027archive\u0027, \u0027background\u0027, \u0027cite\u0027, \u0027classid\u0027,\n     \u0027codebase\u0027, \u0027data\u0027, \u0027href\u0027, \u0027longdesc\u0027, \u0027profile\u0027, \u0027src\u0027,\n     \u0027usemap\u0027, \u0027dynsrc\u0027, \u0027lowsrc\u0027, \u0027formaction\u0027,\n+    \u0027xlink:href\u0027,\n ])\n```\n\nThis single change closes the reported XSS for both SVG `\u003ca xlink:href\u003e` and MathML `\u003ca xlink:href\u003e`. `lxml_html_clean` is the canonical home of the `Cleaner` code (881 lines); `lxml.html.clean` is a 21-line backward-compat shim (`from lxml_html_clean import *`) that picks up the fix automatically once `link_attrs` is updated upstream. Since the upstream change requires lxml maintainer action, see the alternative below if a self-contained patch in `lxml_html_clean` is preferred.\n\n**Alternative (in-package fix, no lxml coordination needed):** add a namespaced-URL-attribute walk inside `Cleaner.__call__` so the URL-scheme filter doesn\u0027t depend on `link_attrs`. Sketch:\n\n```python\n# lxml_html_clean/clean.py \u2014 supplements rewrite_links() in __call__\n_NS_URL_ATTRS = (\u0027xlink:href\u0027,)  # extend as needed\n_BAD_SCHEME = re.compile(r\u0027^\\s*(javascript|vbscript|data):\u0027, re.I)\n\nfor el in doc.iter():\n    for attr in _NS_URL_ATTRS:\n        if attr in el.attrib and _BAD_SCHEME.match(el.attrib[attr]):\n            del el.attrib[attr]\n```\n\nThis decouples the cleaner from the upstream `link_attrs` set and matches the security-ownership boundary established when the cleaner was extracted in lxml 5.2.0.\n\n**Defense in depth (optional, regardless of which fix path is taken):**\n- Also handle `srcset`: the value is a `url 1x, url 2x, \u2026` descriptor list, so split on commas and validate each candidate URL. Not directly executable in current browsers, but closes the same gap.\n- Also accept Clark-notation forms (`{http://www.w3.org/1999/xlink}href`) so XML-mode callers using `lxml.etree` get the same protection. HTML mode never produces this form, so not needed for the reported bug.\n\n## Severity\n\nCVSS 3.1 base score: **8.2 / High** \u2014 `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N` (stored XSS; victim must click the SVG anchor; scope-changed because script executes in the rendering origin). PR:N reflects the common case where untrusted HTML enters the sanitizer from anonymous sources (comments, support tickets); deployments that gate writes behind authentication can score with PR:L (\u2192 7.6).\n\nSeverity is **CONDITIONAL** on the caller passing `safe_attrs_only=False`. With the class default (`True`), attribute allow-listing strips `xlink:href` before scheme scrubbing runs, and the bug does not fire \u2014 verified at HEAD: default-config `Cleaner()(\u003csvg\u003e\u003ca xlink:href=\"javascript:\u2026\"\u003ex\u003c/a\u003e\u003c/svg\u003e)` \u2192 `\u003csvg\u003e\u003ca\u003ex\u003c/a\u003e\u003c/svg\u003e`.\n\n## Prior art / novelty\n\n- **CVE-2021-28957 (lxml 4.6.3)** \u2014 same root cause, different attribute (`formaction`). Fix was a one-line extension of `link_attrs`. Direct precedent.\n- **CVE-2022-34473** (Mozilla Sanitizer API) \u2014 `xlink:href` URL bypass primitive in a different sanitizer.\n- **Bleach (Mozilla, Python)** explicitly handles the `xlink` namespace; `enshrined/svg-sanitize` (PHP) ships `cleanXlinkHrefs()`; DOMPurify scrubs `xlink:href` via `ALLOWED_URI_REGEXP`.\n- **`nh3`** (the alternative recommended in `lxml_html_clean`\u0027s own README for security-sensitive use) is **not vulnerable** to this primitive \u2014 verified 2026-05-10 on `nh3==0.3.5`: with `\u003csvg\u003e`/`\u003cmath\u003e`/`\u003ca\u003e` and `xlink:href` explicitly added to `tags`/`attributes`, both SVG and MathML payloads, all four scheme-encoding variants, are stripped (output e.g. `\u003csvg\u003e\u003ca rel=\"noopener noreferrer\"\u003ex\u003c/a\u003e\u003c/svg\u003e`).\n\n\n## Coordination\n\nFiling as a private GHSA at `fedora-python/lxml_html_clean` \u2014 `lxml_html_clean` is the canonical maintainer of the `Cleaner` code (881 lines) and the security-responsible team since the lxml 5.2.0 split, where the cleaner was extracted out of lxml precisely so cleaner-security reports could land on the right team. The lxml side cannot be filed via GHSA (`https://github.com/lxml/lxml/security/advisories/new` returns 404 \u2014 private reporting is not enabled), so a parallel report has been emailed directly to the lxml maintainer for the upstream `defs.link_attrs` patch path. You\u0027re welcome to coordinate with them directly if you\u0027d prefer the upstream fix over the in-package alternative above.\n\nHappy to provide a draft patch or PR on either path. No bounty expected.",
  "id": "BREW-trafilatura-CVE-2026-49825",
  "modified": "2026-09-17T18:25:17Z",
  "published": "2026-08-13T17:44:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fedora-python/lxml_html_clean"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes",
  "upstream": [
    "GHSA-4jhm-jv67-739f",
    "CVE-2026-49825",
    "PYSEC-2026-2614"
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "lxml",
          "vendor": "lxml",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.1"
            }
          ]
        },
        {
          "product": "lxml_html_clean",
          "vendor": "fedora-python",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5."
    }
  ],
  "id": "CVE-2026-49825",
  "lastModified": "2026-08-21T17:16:31.380",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49825",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T16:41:32.043801Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-20T15:17:30.707",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lxml/lxml/releases/tag/lxml-6.1.1"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "lxml_html_clean"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49825"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-184",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-08T20:23:22Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`)\n\n**Reporter:** Guillem Lefait \u003cguillem@datamq.com\u003e \u00b7 **Date:** 2026-05-10\n**Affected:** `lxml` \u2264 6.1.0 and `lxml_html_clean` \u2264 0.4.4 (latest stable)\n**Confirmed against:** lxml 6.1.0 + lxml_html_clean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 (libxml2 2.14.6 / 2.9.14 \u2014 bug is in pure-Python sanitizer logic, independent of the libxml2 backend)\n**Root-cause class:** same as CVE-2021-28957 (`formaction` missing from `link_attrs`)\n\n## Summary\n\n`Cleaner` filters URL schemes (`javascript:`, `vbscript:`, \u2026) by walking links via `rewrite_links()`, which delegates to `iterlinks()`, which only yields attributes named in `lxml.html.defs.link_attrs`. That allow-list contains no prefixed names (`xlink:href`) and no `srcset`. As a result, when `Cleaner` is configured with `safe_attrs_only=False` \u2014 a documented option for callers that want lenient attribute handling but still expect URL-scheme scrubbing \u2014 `\u003ca xlink:href=\"javascript:\u2026\"\u003e` survives sanitization untouched, and any browser that follows the SVG-anchor specification will execute the JavaScript when the rendered link is clicked.\n\n**CWE:** CWE-79 (XSS), with CWE-184 (Incomplete List of Disallowed Inputs) as the underlying defect class.\n\n## Affected components\n\n| Package            | Versions tested        | File / line                      |\n|--------------------|------------------------|----------------------------------|\n| `lxml`             | 4.9.x, 5.2.1, 6.1.0    | `src/lxml/html/defs.py:20`       |\n| `lxml`             | \"                      | `src/lxml/html/__init__.py:485-528` |\n| `lxml_html_clean`  | 0.4.0 \u2013 0.4.4          | `lxml_html_clean/clean.py:348,576` |\n\nThe legacy `lxml.html.clean` module \u2014 bundled in `lxml \u003c 5.2.0` and still installable on newer versions via the `lxml[html_clean]` extra \u2014 shares the same bug.\n\n## Root cause\n\n`defs.link_attrs` is a flat string set; the literal `xlink:href` is absent:\n\n```python\n# lxml/html/defs.py\nlink_attrs = frozenset([\n    \u0027action\u0027, \u0027archive\u0027, \u0027background\u0027, \u0027cite\u0027, \u0027classid\u0027,\n    \u0027codebase\u0027, \u0027data\u0027, \u0027href\u0027, \u0027longdesc\u0027, \u0027profile\u0027, \u0027src\u0027,\n    \u0027usemap\u0027, \u0027dynsrc\u0027, \u0027lowsrc\u0027, \u0027formaction\u0027,\n])\n```\n\n`HtmlMixin.iterlinks()` (`lxml/html/__init__.py:526-528`) only yields attributes whose key is in that set:\n\n```python\nfor attrib in link_attrs:\n    if attrib in attribs:\n        yield (el, attrib, attribs[attrib], 0)\n```\n\n`Cleaner.__call__` registers the URL-scheme filter via `rewrite_links` (`lxml_html_clean/clean.py:348`), which is a thin wrapper around `iterlinks()`. Because `xlink:href` is never yielded, `_remove_javascript_link` (`clean.py:576`) is never invoked for it.\n\n## Minimal reproducer\n\n```python\nfrom lxml import html\nfrom lxml_html_clean import Cleaner\n\nfor payload in (\n    \u0027\u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e\u0027,\n    \u0027\u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e\u0027,\n):\n    tree = html.fromstring(payload)\n    Cleaner(safe_attrs_only=False)(tree)\n    print(html.tostring(tree).decode())\n    print(\u0027  iterlinks:\u0027, list(html.fromstring(payload).iterlinks()))\n# \u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e     \u2190 unchanged\n#   iterlinks: []                                          \u2190 link rewriter blind\n# \u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e   \u2190 unchanged\n#   iterlinks: []                                          \u2190 link rewriter blind\n```\n\nBoth SVG and MathML scopes are vulnerable \u2014 same allow-list gap, both render anchors that browsers treat as navigable. Other lab-confirmed surviving variants (same scope, different scheme encoding): mixed-case (`JaVaScRiPt:`), HTML-entity (`java\u0026#x73;cript:`), embedded tab (`java\\tscript:`).\n\n## Impact\n\nA caller that uses `Cleaner` to neutralise untrusted HTML and chooses `safe_attrs_only=False` \u2014 typically because the application wants to allow custom data-/aria-/vendor attributes \u2014 will silently pass `javascript:` payloads carried on `xlink:href` through to victim renders. Stored XSS in any application that round-trips user-supplied HTML through this configuration. Reach is conditional on the `safe_attrs_only=False` toggle, but that is a documented public option; consumers reasonably expect URL-scheme scrubbing to be independent of attribute allow-listing.\n\n## Suggested fix\n\n**Extend `link_attrs`** to include `xlink:href`. In HTML mode, `lxml.html` keeps prefixed attribute names verbatim \u2014 the parsed key is the literal string `xlink:href`, not a Clark-notation form \u2014 so the existing allow-list lookup is a plain string match. Same shape as the CVE-2021-28957 fix:\n\n```diff\n # lxml/html/defs.py\n link_attrs = frozenset([\n     \u0027action\u0027, \u0027archive\u0027, \u0027background\u0027, \u0027cite\u0027, \u0027classid\u0027,\n     \u0027codebase\u0027, \u0027data\u0027, \u0027href\u0027, \u0027longdesc\u0027, \u0027profile\u0027, \u0027src\u0027,\n     \u0027usemap\u0027, \u0027dynsrc\u0027, \u0027lowsrc\u0027, \u0027formaction\u0027,\n+    \u0027xlink:href\u0027,\n ])\n```\n\nThis single change closes the reported XSS for both SVG `\u003ca xlink:href\u003e` and MathML `\u003ca xlink:href\u003e`. `lxml_html_clean` is the canonical home of the `Cleaner` code (881 lines); `lxml.html.clean` is a 21-line backward-compat shim (`from lxml_html_clean import *`) that picks up the fix automatically once `link_attrs` is updated upstream. Since the upstream change requires lxml maintainer action, see the alternative below if a self-contained patch in `lxml_html_clean` is preferred.\n\n**Alternative (in-package fix, no lxml coordination needed):** add a namespaced-URL-attribute walk inside `Cleaner.__call__` so the URL-scheme filter doesn\u0027t depend on `link_attrs`. Sketch:\n\n```python\n# lxml_html_clean/clean.py \u2014 supplements rewrite_links() in __call__\n_NS_URL_ATTRS = (\u0027xlink:href\u0027,)  # extend as needed\n_BAD_SCHEME = re.compile(r\u0027^\\s*(javascript|vbscript|data):\u0027, re.I)\n\nfor el in doc.iter():\n    for attr in _NS_URL_ATTRS:\n        if attr in el.attrib and _BAD_SCHEME.match(el.attrib[attr]):\n            del el.attrib[attr]\n```\n\nThis decouples the cleaner from the upstream `link_attrs` set and matches the security-ownership boundary established when the cleaner was extracted in lxml 5.2.0.\n\n**Defense in depth (optional, regardless of which fix path is taken):**\n- Also handle `srcset`: the value is a `url 1x, url 2x, \u2026` descriptor list, so split on commas and validate each candidate URL. Not directly executable in current browsers, but closes the same gap.\n- Also accept Clark-notation forms (`{http://www.w3.org/1999/xlink}href`) so XML-mode callers using `lxml.etree` get the same protection. HTML mode never produces this form, so not needed for the reported bug.\n\n## Severity\n\nCVSS 3.1 base score: **8.2 / High** \u2014 `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N` (stored XSS; victim must click the SVG anchor; scope-changed because script executes in the rendering origin). PR:N reflects the common case where untrusted HTML enters the sanitizer from anonymous sources (comments, support tickets); deployments that gate writes behind authentication can score with PR:L (\u2192 7.6).\n\nSeverity is **CONDITIONAL** on the caller passing `safe_attrs_only=False`. With the class default (`True`), attribute allow-listing strips `xlink:href` before scheme scrubbing runs, and the bug does not fire \u2014 verified at HEAD: default-config `Cleaner()(\u003csvg\u003e\u003ca xlink:href=\"javascript:\u2026\"\u003ex\u003c/a\u003e\u003c/svg\u003e)` \u2192 `\u003csvg\u003e\u003ca\u003ex\u003c/a\u003e\u003c/svg\u003e`.\n\n## Prior art / novelty\n\n- **CVE-2021-28957 (lxml 4.6.3)** \u2014 same root cause, different attribute (`formaction`). Fix was a one-line extension of `link_attrs`. Direct precedent.\n- **CVE-2022-34473** (Mozilla Sanitizer API) \u2014 `xlink:href` URL bypass primitive in a different sanitizer.\n- **Bleach (Mozilla, Python)** explicitly handles the `xlink` namespace; `enshrined/svg-sanitize` (PHP) ships `cleanXlinkHrefs()`; DOMPurify scrubs `xlink:href` via `ALLOWED_URI_REGEXP`.\n- **`nh3`** (the alternative recommended in `lxml_html_clean`\u0027s own README for security-sensitive use) is **not vulnerable** to this primitive \u2014 verified 2026-05-10 on `nh3==0.3.5`: with `\u003csvg\u003e`/`\u003cmath\u003e`/`\u003ca\u003e` and `xlink:href` explicitly added to `tags`/`attributes`, both SVG and MathML payloads, all four scheme-encoding variants, are stripped (output e.g. `\u003csvg\u003e\u003ca rel=\"noopener noreferrer\"\u003ex\u003c/a\u003e\u003c/svg\u003e`).\n\n\n## Coordination\n\nFiling as a private GHSA at `fedora-python/lxml_html_clean` \u2014 `lxml_html_clean` is the canonical maintainer of the `Cleaner` code (881 lines) and the security-responsible team since the lxml 5.2.0 split, where the cleaner was extracted out of lxml precisely so cleaner-security reports could land on the right team. The lxml side cannot be filed via GHSA (`https://github.com/lxml/lxml/security/advisories/new` returns 404 \u2014 private reporting is not enabled), so a parallel report has been emailed directly to the lxml maintainer for the upstream `defs.link_attrs` patch path. You\u0027re welcome to coordinate with them directly if you\u0027d prefer the upstream fix over the in-package alternative above.\n\nHappy to provide a draft patch or PR on either path. No bounty expected.",
  "id": "GHSA-4jhm-jv67-739f",
  "modified": "2026-07-08T20:23:22Z",
  "published": "2026-07-08T20:23:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fedora-python/lxml_html_clean"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes"
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "python-lxml-debuginfo-5.1.0-5.oe2403sp1.aarch64.rpm",
          "python-lxml-debugsource-5.1.0-5.oe2403sp1.aarch64.rpm",
          "python-lxml-help-5.1.0-5.oe2403sp1.aarch64.rpm",
          "python3-lxml-5.1.0-5.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "python-lxml-5.1.0-5.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "python-lxml-debuginfo-5.1.0-5.oe2403sp1.x86_64.rpm",
          "python-lxml-debugsource-5.1.0-5.oe2403sp1.x86_64.rpm",
          "python-lxml-help-5.1.0-5.oe2403sp1.x86_64.rpm",
          "python3-lxml-5.1.0-5.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "python-lxml",
        "purl": "pkg:rpm/openEuler/python-lxml\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.0-5.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "python-lxml-debuginfo-5.1.0-5.oe2403sp3.aarch64.rpm",
          "python-lxml-debugsource-5.1.0-5.oe2403sp3.aarch64.rpm",
          "python-lxml-help-5.1.0-5.oe2403sp3.aarch64.rpm",
          "python3-lxml-5.1.0-5.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "python-lxml-5.1.0-5.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "python-lxml-debuginfo-5.1.0-5.oe2403sp3.x86_64.rpm",
          "python-lxml-debugsource-5.1.0-5.oe2403sp3.x86_64.rpm",
          "python-lxml-help-5.1.0-5.oe2403sp3.x86_64.rpm",
          "python3-lxml-5.1.0-5.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "python-lxml",
        "purl": "pkg:rpm/openEuler/python-lxml\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.0-5.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "python-lxml-debuginfo-5.1.0-5.oe2403sp4.aarch64.rpm",
          "python-lxml-debugsource-5.1.0-5.oe2403sp4.aarch64.rpm",
          "python-lxml-help-5.1.0-5.oe2403sp4.aarch64.rpm",
          "python3-lxml-5.1.0-5.oe2403sp4.aarch64.rpm"
        ],
        "src": [
          "python-lxml-5.1.0-5.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "python-lxml-debuginfo-5.1.0-5.oe2403sp4.x86_64.rpm",
          "python-lxml-debugsource-5.1.0-5.oe2403sp4.x86_64.rpm",
          "python-lxml-help-5.1.0-5.oe2403sp4.x86_64.rpm",
          "python3-lxml-5.1.0-5.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "python-lxml",
        "purl": "pkg:rpm/openEuler/python-lxml\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.0-5.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "python-lxml-debuginfo-4.5.2-11.oe2003sp4.aarch64.rpm",
          "python-lxml-debugsource-4.5.2-11.oe2003sp4.aarch64.rpm",
          "python2-lxml-4.5.2-11.oe2003sp4.aarch64.rpm",
          "python3-lxml-4.5.2-11.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "python-lxml-help-4.5.2-11.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "python-lxml-4.5.2-11.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "python-lxml-debuginfo-4.5.2-11.oe2003sp4.x86_64.rpm",
          "python-lxml-debugsource-4.5.2-11.oe2003sp4.x86_64.rpm",
          "python2-lxml-4.5.2-11.oe2003sp4.x86_64.rpm",
          "python3-lxml-4.5.2-11.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "python-lxml",
        "purl": "pkg:rpm/openEuler/python-lxml\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.2-11.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "python-lxml-debuginfo-4.7.1-10.oe2203sp4.aarch64.rpm",
          "python-lxml-debugsource-4.7.1-10.oe2203sp4.aarch64.rpm",
          "python3-lxml-4.7.1-10.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "python-lxml-help-4.7.1-10.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "python-lxml-4.7.1-10.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "python-lxml-debuginfo-4.7.1-10.oe2203sp4.x86_64.rpm",
          "python-lxml-debugsource-4.7.1-10.oe2203sp4.x86_64.rpm",
          "python3-lxml-4.7.1-10.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "python-lxml",
        "purl": "pkg:rpm/openEuler/python-lxml\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-10.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "\\\r\n\r\nSecurity Fix(es):\n\nlxml_html_clean.Cleaner does not strip javascript: URLs from namespaced URL attributes (xlink:href). The vulnerability exists because Cleaner filters URL schemes by walking links via rewrite_links(), which delegates to iterlinks(), which only yields attributes named in lxml.html.defs.link_attrs. That allow-list contains no prefixed names such as xlink:href. As a result, when Cleaner is configured with safe_attrs_only=False, an xlink:href attribute carrying a javascript: URL survives sanitization untouched, and any browser that follows the SVG or MathML anchor specification will execute the JavaScript when the rendered link is clicked, leading to Cross-Site Scripting (XSS) attacks.(CVE-2026-49825)",
  "id": "OESA-2026-3217",
  "modified": "2026-08-06T11:12:05Z",
  "published": "2026-08-01T11:12:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3217"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49825"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "python-lxml security update",
  "upstream": [
    "CVE-2026-49825"
  ]
}