StackPrism

PyPI package

lxml vulnerabilities by version

The latest release, 6.1.3 (Sep 2, 2026), has no known vulnerabilities. 6 of the 10 most recent releases have known vulnerabilities. OSV.dev lists 7 advisories for lxml; the newest was published on Apr 21, 2026.

PyPI (opens in a new tab) describes it as “Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.”

Latest release
6.1.3
Sep 2, 2026, no known vulnerabilities
Downloads last week
89.1M
All versions, from pypistats.org
Advisories on OSV.dev
7
Newest Apr 21, 2026
Licence
BSD-3-Clause
OpenSSF Scorecard
5.6/10
lxml/lxml (opens in a new tab)

Recent releases

PyPI doesn’t publish downloads per version, so these are the newest releases, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilities
6.1.3latestSep 2, 2026No known vulnerabilities
6.1.2Aug 19, 2026No known vulnerabilities
6.1.1May 18, 2026No known vulnerabilities
6.1.0Apr 18, 2026No known vulnerabilities
6.0.4Apr 12, 20261 known vulnerability, worst rated critical
6.0.3Apr 9, 20261 known vulnerability, worst rated critical
6.0.2Sep 22, 20251 known vulnerability, worst rated critical
6.0.1Aug 22, 20251 known vulnerability, worst rated critical
6.0.0Jun 26, 20251 known vulnerability, worst rated critical
5.4.0Apr 23, 20251 known vulnerability, worst rated critical

Release lines

The newest release of each minor line, from the registry. lxml doesn’t publish support dates we can check.

LineNewest releaseReleased
6.16.1.3Sep 2, 2026
6.06.0.4Apr 12, 2026
5.45.4.0Apr 23, 2025
5.35.3.2Apr 5, 2025
5.25.2.2May 13, 2024
5.15.1.1Mar 29, 2024

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. CriticalCVE-2026-41066 on OSV.dev (opens in a new tab)GHSA-vfmq-68hx-4jfw

    lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

    Affects < 6.1.0. Published Apr 21, 2026.

  2. WarningCVE-2022-2309 on OSV.dev (opens in a new tab)GHSA-wrxv-2j5q-m38w

    lxml NULL Pointer Dereference allows attackers to cause a denial of service

    Affects < 4.9.1. Published Jul 6, 2022.

  3. WarningCVE-2014-3146 on OSV.dev (opens in a new tab)GHSA-57qw-cc2g-pv5p

    lxml Cross-site Scripting Via Control Characters

    Affects < 3.3.5. Published May 14, 2022.

  4. WarningCVE-2018-19787 on OSV.dev (opens in a new tab)GHSA-xp26-p53h-6h2p

    Improper Neutralization of Input During Web Page Generation in LXML

    Affects < 4.2.5. Published May 13, 2022.

  5. WarningCVE-2021-43818 on OSV.dev (opens in a new tab)GHSA-55x5-fj6c-h6m8

    lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through

    Affects < 4.6.5. Published Dec 13, 2021.

All 7 advisories are on OSV.dev (opens in a new tab).

Which lxml do you have?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for lxml, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from pypistats.org. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, PyPI, pypistats.org and deps.dev.