Improper Restriction of XML External Entity Reference in python-docx
High severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Dec 8, 2023
Description
Published by the National Vulnerability Database
Dec 21, 2016
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Jul 6, 2022
Last updated
Dec 8, 2023
python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.
References