diff --git a/src/pybind/mgr/dashboard/requirements.txt b/src/pybind/mgr/dashboard/requirements.txt
index c63b61940ca0c..6140660bce218 100644
--- a/src/pybind/mgr/dashboard/requirements.txt
+++ b/src/pybind/mgr/dashboard/requirements.txt
@@ -9,3 +9,4 @@ requests
 Routes
 six
 -e ../../../python-common
+lxml>=4.9.1 # not directly required, pinned by Snyk to avoid a vulnerability