Critical · 9.8 CVE-2020-18703 EUVD-2021-0218GHSA-3xg5-6c3j-vp8xPYSEC-2021-144

Improper Restriction of XML External Entity Reference in Quokka

Published Aug 16, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.

Ecosystem	Package	Affected	Fixed	Record
PyPI	quokka	<= 0.4.0	—	GHSA-3xg5-6c3j-vp8x
PyPI	quokka	all versions	—	PYSEC-2021-144