CVE-2021-29421
Improper Restriction of XML External Entity Reference in pikepdf
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
- Record
CVE-2021-29421- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
- Record
CVE-2021-29421- Updated
- 2026-11-02
EUVDEUVD-2021-0166 No score
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
- Record
EUVD-2021-0166- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ccgm-3xw4-h5p8
Improper Restriction of XML External Entity Reference in pikepdf
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
- Record
GHSA-ccgm-3xw4-h5p8- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-29421
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
- Record
ALPINE-CVE-2021-29421- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
- Record
CVE-2021-29421- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2021-29421
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
- Record
DEBIAN-CVE-2021-29421- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-ccgm-3xw4-h5p8
Improper Restriction of XML External Entity Reference in pikepdf
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
- Record
GHSA-ccgm-3xw4-h5p8- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-29421
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
- Record
UBUNTU-CVE-2021-29421- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2021-0268 No score
Updated python-pikepdf packages fix security vulnerability
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries (CVE-2021-29421).
- Record
MGASA-2021-0268- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11250-1 No score
python36-pikepdf-2.12.1-1.3 on GA media
These are all security issues fixed in the python36-pikepdf-2.12.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11250-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13864-1 No score
python310-pikepdf-8.15.0-1.1 on GA media
These are all security issues fixed in the python310-pikepdf-8.15.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13864-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11355-1 No score
python313-pikepdf-10.5.1-2.1 on GA media
These are all security issues fixed in the python313-pikepdf-10.5.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11355-1- Updated
- 2026-11-02
OSVPYSEC-2021-34 No score
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
- Record
PYSEC-2021-34- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pikepdfPyPI |
1.3.0 up to 2.10.0 | 2.10.0 |
py3-pikepdfAlpine:v3.14 |
before 2.9.1-r2 | 2.9.1-r2 |
py3-pikepdfAlpine:v3.15 |
before 2.9.1-r2 | 2.9.1-r2 |
py3-pikepdfAlpine:v3.16 |
before 2.9.1-r2 | 2.9.1-r2 |
py3-pikepdfAlpine:v3.17 |
before 2.9.1-r2 | 2.9.1-r2 |
py3-pikepdfAlpine:v3.18 |
before 2.9.1-r2 | 2.9.1-r2 |
py3-pikepdfAlpine:v3.19 |
before 2.9.1-r2 | 2.9.1-r2 |
py3-pikepdfAlpine:v3.20 |
before 2.9.1-r2 | 2.9.1-r2 |
py3-pikepdfAlpine:v3.21 |
before 2.9.1-r2 | 2.9.1-r2 |
py3-pikepdfAlpine:v3.22 |
before 2.9.1-r2 | 2.9.1-r2 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
py3-pikepdfAlpine:v3.23 |
before 2.9.1-r2 | 2.9.1-r2 |
py3-pikepdfAlpine:v3.24 |
before 2.9.1-r2 | 2.9.1-r2 |
pikepdfDebian:12 |
before 1.17.3+dfsg-5 | 1.17.3+dfsg-5 |
pikepdfDebian:13 |
before 1.17.3+dfsg-5 | 1.17.3+dfsg-5 |
pikepdfDebian:14 |
before 1.17.3+dfsg-5 | 1.17.3+dfsg-5 |
pikepdfPyPI |
1.3.0 up to 2.10.0, plus listed versions 1.10.01.10.11.10.21.10.31.10.4 Show 45 moreShow less1.11.01.11.11.11.21.12.01.13.01.14.01.15.01.15.11.16.01.16.11.17.01.17.11.17.21.17.31.18.01.19.01.19.11.19.21.19.31.19.41.3.11.4.01.5.0.post01.6.01.6.11.6.21.6.31.6.41.6.51.7.01.7.11.8.01.8.11.8.21.8.31.9.02.0.02.1.02.1.12.1.22.2.02.2.12.2.22.2.32.2.4 |
2.10.0 |
python-pikepdfMageia:8 |
before 2.10.0-1.mga8 | 2.10.0-1.mga8 |
pikepdfPyPI |
1.3.0 up to 2.10.0, plus listed versions 1.3.11.4.01.5.01.5.0.post01.6.0 Show 45 moreShow less1.6.11.6.21.6.31.6.41.6.51.7.01.7.11.8.01.8.11.8.21.8.31.9.01.10.01.10.11.10.21.10.31.10.41.11.01.11.11.11.21.12.01.13.01.14.01.15.01.15.11.16.01.16.11.17.01.17.11.17.21.17.31.18.01.19.01.19.11.19.21.19.31.19.42.0.0b12.0.0b22.0.02.1.02.1.12.1.22.2.02.2.1 |
2.10.0 |
pikepdfUbuntu:20.04:LTS |
All versions, plus listed versions 1.6.4+dfsg-11.6.4+dfsg-1build11.6.5+dfsg-11.7.0+dfsg-11.8.1+dfsg-11.10.0+dfsg-1build11.10.3+dfsg-1 |
None known |
pikepdfUbuntu:22.04:LTS |
All versions, plus listed versions 1.17.3+dfsg-5ubuntu13.2.0+dfsg-24.2.0+dfsg-15.0.1+dfsg-1 |
None known |
pikepdfUbuntu:24.04:LTS |
All versions, plus listed versions 8.3.2+dfsg-18.5.1+dfsg-18.5.1+dfsg-1build18.7.1+dfsg-28.7.1+dfsg-2build18.7.1+dfsg-2build2 |
None known |
pikepdfUbuntu:25.10 |
All versions, plus listed versions 9.5.2+dfsg-1build2 |
None known |
pikepdfUbuntu:26.10 |
All versions, plus listed versions 10.3.0+dfsg-1build110.5.0+dfsg-2 |
None known |
pikepdfUbuntu:26.04:LTS |
All versions, plus listed versions 9.5.2+dfsg-1build29.5.2+dfsg-1build310.2.0+dfsg-110.3.0+dfsg-110.3.0+dfsg-1build1 |
None known |
python-pikepdfopenSUSE:Tumbleweed |
before 10.5.1-2.1 | 10.5.1-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29421 is a high vulnerability (CVSS 7.5) in Pikepdf Project Pikepdf, published April 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 77th percentile. Fixed in pikepdf 2.10.0.
References
github.com/pikepdf/pikepdf/commit/3f38f73218e5e782fe411ccbb3b44a793c0b343a
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QFLBBYGEDNXJ7FS6PIWTVI4T4BUPGEQ
nvd.nist.gov/vuln/detail/CVE-2021-29421
Show 11 moreShow less
security.alpinelinux.org/vuln/CVE-2021-29421
security-tracker.debian.org/tracker/CVE-2021-29421
advisories.mageia.org/MGASA-2021-0268.html
bugs.mageia.org/show_bug.cgi?id=29022
ubuntu.com/security/CVE-2021-29421
cve.org/CVERecord?id=CVE-2021-29421
suse.com/security/cve/CVE-2021-29421
Left out here: 30 versions. The JSON record has them.