Guillem Lefait discovered that lxml incorrectly handled certain URL attributes. A remote attacker could possibly use this issue to bypass URL sanitization, leading to a cross-site scripting attack. (CVE-2026-49825) Qiu Sihao discovered that lxml incorrectly handled untrusted XML input. A remote...