Logo
componentpython3-xmltodict
Name
python3-xmltodict
Version
0.13.0
Type
library
Description
Makes working with XML feel like you are working with JSON
Licenses
MIT
PURL
-
CPE
cpe:2.3:*:*:python3-xmltodict:0.13.0:*:*:*:*:*:*:*

Other Versions#


Project
Branch
Version
kirkstone
0.12.0
master
1.0.4

Patches#


#
Title
Author
Resolve
1
Prevent XML injection: reject '<'/'>' in element/attr names
Martin Blech <78768+martinblech@users.noreply.github.com>
CVE-2025-9375
2
Enhance unparse() XML name validation with stricter rules and
Martin Blech <78768+martinblech@users.noreply.github.com>
CVE-2025-9375

Vulnerabilities#


Name
Analysis
Description
Patched
XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.