lxml, a Python library for XML and HTML processing, omitted the xlink:href attribute from its link attribute list (lxml.html.defs.link_attrs) until version 6.1.1. Attackers can embed javascript: URLs in SVG or MathML elements that the library mistakenly treats as safe, allowing an attacker to inject executable code into a page that is processed with lxml. This vulnerability effectively bypasses the library’s sanitisation and enables arbitrary script execution within the context of the application.

The flaw affects any systems running lxml versions earlier than 6.1.1 or the related lxml_html_clean packages before release 0.4.5, which are provided by the fedora-python project and the lxml package. Applications that import the older lxml library or use the lxml_html_clean cleaner without the patch are potentially exploitable.

The CVSS score of 8.2 indicates a high severity and the absence of an EPSS score shows limited current exploitation data, while the vulnerability is not listed in the CISA KEV catalog. The likely attack vector relies on an attacker supplying crafted SVG, MathML or other structured content to the application that uses lxml’s HTML cleaning. Because the affected code runs with the privileges of the application, successful exploitation would allow execution of arbitrary client‑side script in the context of the user interacting with the application.