Lxml is a widely embedded XML and HTML parsing library that, despite a narrow product scope, is deeply integrated across Python-based web frameworks, data-processing pipelines, and content-handling applications. Vulnerabilities in the library recur through input-handling and parsing-related weakness classes including cross-site scripting, injection flaws, XML external entity references, and NULL-pointer dereferences that reflect the complexity of robust markup parsing. The vendor's disclosures have an elevated tendency toward public exploit-code availability, underscoring the appeal of parser flaws to downstream attackers. Defenders should inventory applications and frameworks that depend on this library rather than treating lxml in isolation, since remediation typically requires rebuilding dependent software; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Lxml over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-41066HIGH lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allo | Apr 24, 2026 | 7.5 | 31 | NO | NO |
CVE-2021-43818HIGH lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as wel | Dec 13, 2021 | 7.1 | 27 | NO | NO |
CVE-2014-3146MEDIUM Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters i | May 14, 2014 | 6.1 | 27 | NO | YES |
CVE-2021-28957MEDIUM An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove t | Mar 21, 2021 | 6.1 | 23 | NO | NO |
CVE-2020-27783MEDIUM A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and t | Dec 3, 2020 | 6.1 | 23 | NO | NO |
CVE-2022-2309HIGH NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libx | Jul 5, 2022 | 7.5 | 22 | NO | NO |
CVE-2018-19787MEDIUM An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to con | Dec 2, 2018 | 6.1 | 22 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Lxml.
Media articles that mention a CVE ID that affects a product developed by Lxml — matched by CVE ID, not by vendor name.