From d38df0a70a93ae4e033b2d311375462014e3a101 Mon Sep 17 00:00:00 2001
From: ali <shenzhongli@ieisystem.com>
Date: Mon, 31 Aug 2026 20:29:46 +0800
Subject: [PATCH] [CVE][upstream] FIX CVE-2026-49825

to #44816
add patch to fix CVE-2026-49825
commit 322357ac61c6cf80fcbaba53b4e92e31f3ded9f2 upstream.
Project: TC2024080204
---
 fix-CVE-2026-49825.patch | 40 ++++++++++++++++++++++++++++++++++++++++
 python-lxml.spec         |  7 ++++++-
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 fix-CVE-2026-49825.patch

diff --git a/fix-CVE-2026-49825.patch b/fix-CVE-2026-49825.patch
new file mode 100644
index 0000000..518aa1f
--- /dev/null
+++ b/fix-CVE-2026-49825.patch
@@ -0,0 +1,40 @@
+From 5927a6d5e851845140975d99b65461e255caaab0 Mon Sep 17 00:00:00 2001
+From: Stefan Behnel <stefan_ml@behnel.de>
+Date: Sun, 17 May 2026 21:42:51 +0200
+Subject: [PATCH] Add missing "xlink:href" to the known HTML link attributes.
+ Closes
+ https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f
+
+Conflict:NA
+Reference:https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0
+
+---
+ src/lxml/html/defs.py | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/lxml/html/defs.py b/src/lxml/html/defs.py
+index 30f44a7f..20efb7a3 100644
+--- a/src/lxml/html/defs.py
++++ b/src/lxml/html/defs.py
+@@ -24,7 +24,9 @@ link_attrs = frozenset([
+     # Not standard:
+     'dynsrc', 'lowsrc',
+     # HTML5 formaction
+-    'formaction'
++    'formaction',
++    # XLink as used by HTML5 (including embedded SVG/MathML)
++    'xlink:href',
+     ])
+ 
+ # Not in the HTML 4 spec:
+@@ -133,7 +135,7 @@ font_style_tags = frozenset([
+ frame_tags = frozenset([
+     'frameset', 'frame', 'noframes',
+     ])
+-    
++
+ html5_tags = frozenset([
+     'article', 'aside', 'audio', 'canvas', 'command', 'datalist',
+     'details', 'embed', 'figcaption', 'figure', 'footer', 'header',
+-- 
+2.43.0
diff --git a/python-lxml.spec b/python-lxml.spec
index 524dede..2a2fa9d 100644
--- a/python-lxml.spec
+++ b/python-lxml.spec
@@ -1,4 +1,4 @@
-%define anolis_release 1
+%define anolis_release 2
 %global modname lxml
 
 Name:           python-%{modname}
@@ -13,6 +13,8 @@ Summary:        XML processing library combining libxml2/libxslt with the Elemen
 License:        BSD and MIT and zlib
 URL:            https://github.com/lxml/lxml
 Source0:        https://github.com/lxml/lxml/archive/refs/tags/%{modname}-%{version}.tar.gz
+# https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2
+Patch1: fix-CVE-2026-49825.patch
 
 BuildRequires:  gcc
 BuildRequires:  libxml2-devel
@@ -89,6 +91,9 @@ make test
 %doc README.rst src/lxml/isoschematron/resources/xsl/iso-schematron-xslt1/readme.txt
 
 %changelog
+* Mon Aug 31 2026 ali-inspur <shenzhongli@inspur.com> - 6.1.0-2
+- Fix CVE-2026-49825
+
 * Mon May 11 2026 lzq11122 <lzq02303433@alibaba-inc.com> - 6.1.0-1
 - Update to 6.1.0 to fix CVE-2026-41066
 
-- 
Gitee