lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

A vulnerability in the lxml Python library (CVE-2026-49825) was discovered where the `xlink:href` attribute was missing from `lxml.html.defs.link_attrs`. This omission allowed attackers to perform URL bypass attacks using embedded SVG, MathML, or other content types. The flaw could be exploited to circumvent URL sanitization mechanisms in applications relying on lxml for HTML processing. The vulnerability affects all versions of lxml prior to 6.1.1 and lxml_html_clean prior to 0.4.5. Fixes were released in lxml 6.1.1 and lxml_html_clean 0.4.5. Patches and release notes are available on GitHub for both the lxml and lxml_html_clean projects. Users are advised to upgrade to the patched versions immediately to mitigate the risk.