Red Hat Patches Important lxml Sanitizer Flaw Allowing URL Filter Bypass
Red Hat issued security advisory RHSA-2026:90326 on 26 October 2026, correcting a single flaw in the python-lxml package. The issue is tracked as CVE-2026-49825 and is described as a URL bypass vulnerability in the lxml-html-clean Cleaner component, caused by missing handling of the xlink:href attribute. Red Hat Product Security rated the update as Important. The advisory covers Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, across x86_64, aarch64, ppc64le and s390x builds, meaning customers still running 8.4 under extended life-cycle contracts are the population in scope.
lxml is the widely used XML and HTML processing library for Python, and its Cleaner class is commonly relied upon to strip dangerous markup and links out of untrusted HTML before that content is rendered or stored. According to the advisory, the Cleaner failed to account for xlink:href, leaving a path for a URL to survive sanitisation that the filter was expected to remove. No CVSS base score is reproduced in the errata text itself; the vendor points readers to the CVE page and to Bugzilla ticket BZ-2520368 for the full severity breakdown. What is clear from the errata is the fix level: the rebuilt packages are python-lxml-4.2.3-2.el8_4.1, shipping as the SRPM plus python3-lxml, python3-lxml-debuginfo and python-lxml-debugsource for each supported architecture.
Sanitiser bypasses matter because they sit on a trust boundary that developers rarely re-check. Any application that passes user-supplied or third-party HTML through lxml's Cleaner is treating the output as safe by definition, so a filter gap can quietly reintroduce attacker-controlled links into pages, feeds, mail bodies or documents that downstream code assumes have already been scrubbed. The exposure is concentrated in long-lived estates: organisations paying for AUS or ELS coverage on RHEL 8.4 are typically running regulated, change-controlled workloads that cannot be rebuilt quickly, and those same workloads often process externally sourced content. FIRST EPSS places the probability of exploitation of CVE-2026-49825 in the next 30 days at 0.3 percent, and neither the advisory nor the verified exploitation data records any in-the-wild activity against this flaw.
Attack Surface
Web Application, Server OS
Tactics
Defense Evasion, Initial Access
Techniques
- T1190 – Exploit Public-Facing Application
- T1059.007 – Command and Scripting Interpreter: JavaScript
- T1027 – Obfuscated Files or Information
SuperPRO's Threat Countermeasures Procedures
- Apply RHSA-2026:90326 and move python-lxml to 4.2.3-2.el8_4.1 on all Red Hat Enterprise Linux 8.4 AUS and ELS Long Life hosts, covering the x86_64, aarch64, ppc64le and s390x builds of python3-lxml.
- Verify the installed level with 'rpm -q python3-lxml' or 'dnf list installed python3-lxml' and treat any host still reporting 4.2.3-2.el8_4 or earlier as unremediated against CVE-2026-49825.
- Use Red Hat Insights patch analysis, referenced in the errata, to enumerate which subscribed 8.4 systems are flagged for RHSA-2026:90326 rather than relying on manual inventory of extended-life-cycle hosts.
- Validate SRPM and binary integrity before deployment against the SHA-256 values published in the errata, for example b60921f52ac736c567c87271de0cae28b230371dd9945d25b68e54b9aab11e7a for python-lxml-4.2.3-2.el8_4.1.src.rpm.
- Grep application code for imports of lxml.html.clean and uses of the Cleaner class, and record those services as the blast radius for this sanitiser bypass so they can be restarted after the package upgrade takes effect.
- For any service that renders untrusted HTML through Cleaner, add a second-stage check that rejects or neutralises xlink:href attributes in SVG and XML fragments until the patched package is confirmed loaded in the running interpreter.
- Track Bugzilla BZ-2520368 and the CVE-2026-49825 page for an updated CVSS base score and any revised Red Hat guidance, and feed changes into the next patch cycle review for 8.4 extended-support estates.
