High · 7.5 CVE-2020-26710 EUVD-2023-0072GHSA-vv6q-6hwp-vrgpPYSEC-2023-97

easy-parse XML External Entity Injection vulnerability

Published Jun 29, 2023 · Updated Nov 27, 2024 · Assigned by mitre

Description

easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	easy-parse	<= 0.1.1	—	GHSA-vv6q-6hwp-vrgp
PyPI	easy-parse	all versions	—	PYSEC-2023-97

References

https://github.com/uncmath25/easy-parse/issues/3