High · 7.5 CVE-2020-26709 EUVD-2023-0211GHSA-j6v2-mwxm-f952PYSEC-2023-95

py-xml XML External Entity Injection vulnerability

Published Jun 29, 2023 · Updated Nov 27, 2024 · Assigned by mitre

Description

py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	py-xml	<= 1.0	—	GHSA-j6v2-mwxm-f952
PyPI	py-xml	all versions	—	PYSEC-2023-95

References

https://github.com/PinaeOS/py-xml/issues/2