Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-24 | 1 | Disclosure1 |
| 2026-05-01 | 1 | Patch1 |
`OpenHands/OpenHands` shipped v1.7.0 with `SANDBOX_KVM_ENABLED` for hardware-accelerated virtualization. Concurrently, the repo branched fixes for CVE-2026-41066, addressing security alongside a major performance boost for agent sandboxes.
Post summary
OpenHands released v1.7.0 and applied a patch for CVE‑2026‑41066, adding hardware‑accelerated virtualization and performance gains to agent sandboxes.
CVE-2026-41066 lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entit… https://www.cve.org/CVERecord?id=CVE-2026-41066
Post summary
The post mentions CVE‑2026‑41066 for the lxml Python library, providing minimal technical details about the affected configuration but lacking proof‑of‑concept, exploit code, patch information, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | lxml | lxml | - | - | - |