CVE-2025-9375: falha de média gravidade em xmltodict
xmltodict 0.14.2 - XML Injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.5%
XML Injection vulnerability in xmltodict allows Input Data Manipulation.
This issue affects xmltodict: from 0.14.2 before 0.15.1.
NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
xmltodict · xmltodictReferências
https://docs.python.org/3/library/xml.sax.utils.html#xml.sax.saxutils.escapehttps://docs.python.org/3/library/xml.sax.utils.html#xml.sax.saxutils.XMLGeneratorhttps://fluidattacks.com/advisories/monohttps://github.com/martinblech/xmltodicthttps://github.com/martinblech/xmltodict/blob/v0.15.1/CHANGELOG.mdhttps://github.com/martinblech/xmltodict/commit/f98c90f071228ed73df997807298e1df4f790c33https://github.com/martinblech/xmltodict/issues/377#issuecomment-3255691923