GHSA-whf4-fpj8-pgg8

ebookmeta XML External Entity vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-36827

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ebookmeta	< 1.2.8	1.2.8

Details

As written in the advisory (Markdown source, shown as plain text).

An XML External Entity (XXE) vulnerability in the `ebookmeta.get_metadata` function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-36827 advisory
https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335 web
https://github.com/dnkorpushov/ebookmeta package
https://github.com/pypa/advisory-database/tree/main/vulns/ebookmeta/PYSEC-2024-76.yaml web