Description
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openpyxl | 2.3.0-3 | — |
| Debian 13 | openpyxl | 2.3.0-3 | — |
| Debian 12 | openpyxl | 2.3.0-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | openpyxl | 2.3.0-1ubuntu0.1~esm1 | USN-4821-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-openpyxl | 3.1.3-1.1 | openSUSE-SU-2026:12023-1, openSUSE-SU-2024:14028-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openpyxl | < 2.4.2 | 2.4.2 | GHSA-chqf-hx79-gxc6 |
| PyPI | openpyxl | < 2.4.1 | 2.4.1 | PYSEC-2017-48 |
Advisories 3
- openSUSE-SU-2026:12023-1 python313-openpyxl-3.1.5-1.8 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- USN-4821-1 openpyxl vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- openSUSE-SU-2024:14028-1 python310-openpyxl-3.1.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026