Came across something in uv.lock around line 1 that looked worth flagging.
The installed lxml version 6.0.4 contains a high‑severity XML external entity (XXE) vulnerability (CVE‑2026‑41066). With the default parser configuration (resolve_entities=True), an attacker can craft malicious XML that reads arbitrary local files, leading to information disclosure or further server compromise. The risk is high because it allows untrusted input to break out of XML processing and access the filesystem. Updating to lxml 6.1.0 or explicitly disabling entity resolution eliminates the issue.
Something like this might fix it:
--- a/uv.lock
+++ b/uv.lock
@@ -1 +1 @@
-lxml==6.0.4
+lxml==6.1.0
For reference: rule CVE-2026-41066. Rated high.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
uv.lockaround line 1 that looked worth flagging.The installed lxml version 6.0.4 contains a high‑severity XML external entity (XXE) vulnerability (CVE‑2026‑41066). With the default parser configuration (
resolve_entities=True), an attacker can craft malicious XML that reads arbitrary local files, leading to information disclosure or further server compromise. The risk is high because it allows untrusted input to break out of XML processing and access the filesystem. Updating to lxml 6.1.0 or explicitly disabling entity resolution eliminates the issue.Something like this might fix it:
For reference: rule
CVE-2026-41066. Rated high.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.