GHSA-gp6m-vqhm-5cm5

XML2Dict XML Entity Expansion Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2021-25951

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	XML2Dict	<= 0.2.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. The parse function does not properly restrict recursive entity references.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-25951 advisory
https://github.com/mcspring/XML2Dict/tree/master web
https://github.com/mcspring/xml2dict package
https://github.com/pypa/advisory-database/tree/main/vulns/xml2dict/PYSEC-2021-349.yaml web
https://pypi.org/project/XML2Dict web
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25951 web