Description

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-20T15:17:30.707Z",
  "pubdate": "2026-08-20T15:17:30.707Z",
  "executiveSummary": "An incomplete attribute sanitization vulnerability exists in the lxml library prior to version 6.1.1 and lxml_html_clean prior to version 0.4.5. The vulnerability arises from missing xlink:href link attributes within lxml.html.defs.link_attrs, which are utilized during the processing of embedded SVG, MathML, and other markup languages containing hyperlinks. This flaw enables attackers to execute URL bypass attacks by smuggling malicious uniform resource identifiers past HTML sanitization filters. Successful exploitation can lead to security control bypasses, potentially facilitating cross-site scripting (XSS), malicious redirection, or unauthorized data exfiltration depending on how the sanitized HTML output is consumed by downstream applications. The vulnerability impacts systems processing untrusted HTML and XML inputs utilizing affected versions of lxml and lxml_html_clean. Attackers require the capability to inject crafted markup containing embedded content utilizing the unhandled xlink:href attribute to trigger the vulnerability. Exploitation relies on the parser failing to normalize and sanitize the specific namespace-qualified attribute during the cleaning phase.",
  "technicalDetails": "The root cause of the vulnerability resides in the omission of the xlink:href attribute from the predefined list of link attributes defined in lxml.html.defs.link_attrs. The lxml library is a widely used Python library designed for processing XML and HTML content, often employed alongside cleaning modules like lxml_html_clean to sanitize user-supplied markup by stripping dangerous tags and attributes.\nWithin XML-based embedded contexts such as Scalable Vector Graphics (SVG) and Mathematical Markup Language (MathML), hyperlinking and resource referencing can be achieved using namespace-prefixed attributes, most notably xlink:href, rather than standard HTML href attributes. Because lxml.html.defs.link_attrs historically lacked xlink:href, sanitization routines failed to inspect, validate, or neutralize URLs embedded within this specific attribute.\nThe attack flow begins when an unauthenticated user supplies malicious HTML containing embedded SVG or MathML structures that leverage the unmonitored xlink:href attribute to point to external or malicious URLs containing payloads such as JavaScript URIs. When the application passes this input through the vulnerable lxml HTML cleaning pipeline, the sanitization mechanism strips standard href attributes while inadvertently preserving the xlink:href attribute due to the missing definition.\nDownstream rendering engines or web browsers subsequently parse the sanitized output, encountering the surviving xlink:href attribute within the embedded SVG or MathML context. The browser resolves the URI defined in the attribute, resulting in a successful URL bypass of security controls. This can lead to the execution of malicious scripts, arbitrary resource loading, or redirection to attacker-controlled infrastructure without requiring elevated privileges, specific authentication states, or complex network-level interactions beyond the ability to inject crafted markup into an application processing untrusted content."
}