Critical · 9.8 CVE-2020-18705 EUVD-2021-0219GHSA-4q2r-qxp6-h5j6PYSEC-2021-145

Improper Restriction of XML External Entity Reference in Quokka

Published Aug 16, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'.

Ecosystem	Package	Affected	Fixed	Record
PyPI	quokka	<= 0.4.0	—	GHSA-4q2r-qxp6-h5j6
PyPI	quokka	all versions	—	PYSEC-2021-145