Skip to content
OpenAdvisories
Medium USN-7753-1 1 CVE

python-xmltodict vulnerability

Published Sep 16, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Camilo Vera discovered that xmltodict parsed maliciously crafted XML input,
contrary to expectations. An attacker could possibly use this issue to
cause a denial of service, obtain sensitive information, or execute
arbitrary code.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS python-xmltodict 0.13.0-1ubuntu0.24.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS python-xmltodict 0.9.2-3ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS python-xmltodict 0.11.0-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-xmltodict 0.12.0-1ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS python-xmltodict 0.12.0-2ubuntu0.1~esm1

Vulnerabilities 1

  • Medium 6.9
    CVE-2025-9375

    xmltodict 0.14.2 - XML Injection

    XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to …

    xmltodict xmltodict python-xmltodict python-xmltodict Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2025-9375