Every CVE Search/ Get API key

CVE-2023-27476

XML External Entity (XXE) Injection in OWSLib

8.2 HighFix available

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
Low

Exploit likelihood

0.98%Up 0.9 points since Mar 8, 2023
90%50%10%1%

What each source reports

CVE List Score used 8.2

XML External Entity (XXE) Injection in OWSLib

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.

Record
CVE-2023-27476
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-611
Updated
2026-11-02
EUVDEUVD-2023-0189 8.2

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.

Record
EUVD-2023-0189
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-8h9c-r582-mggc 8.8

OWSLib vulnerable to XML External Entity (XXE) Injection

Impact

OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.

Patches

Workarounds

patch_well_known_namespaces(etree)
etree.set_default_parser(
    parser=etree.XMLParser(resolve_entities=False)
)

References

Record
GHSA-8h9c-r582-mggc
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-611
Updated
2026-11-02
NVD 8.2

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.

Record
CVE-2023-27476
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-611
Updated
2026-11-02
OSV 8.2

XML External Entity (XXE) Injection in OWSLib

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.

Record
CVE-2023-27476
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-611
Updated
2026-11-02
OSVDEBIAN-CVE-2023-27476 7.5

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.

Record
DEBIAN-CVE-2023-27476
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-8h9c-r582-mggc 8.8

OWSLib vulnerable to XML External Entity (XXE) Injection

Impact

OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.

Patches

Workarounds

patch_well_known_namespaces(etree)
etree.set_default_parser(
    parser=etree.XMLParser(resolve_entities=False)
)

References

Record
GHSA-8h9c-r582-mggc
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-611
Updated
2026-11-02
OSVUBUNTU-CVE-2023-27476 8.2

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.

Record
UBUNTU-CVE-2023-27476
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2023-0112 No score

Updated python-owslib packages fix security vulnerability

XML External Entity (XXE) Injection (CVE-2023-27476)

Record
MGASA-2023-0112
Updated
2026-11-02
OSVPYSEC-2023-86 No score

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.

Record
PYSEC-2023-86
Updated
2026-11-02
OSVUSN-8247-1 No score

owslib vulnerability

It was discovered that OWSLib did not properly disable entity resolution within its XML parser. An attacker could possibly use this issue to read arbitrary files via a crafted XML payload.

Record
USN-8247-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
owslib
PyPI
 before 0.28.1
0.28.1
owslib
Debian:12
 before 0.27.2-3
0.27.2-3
owslib
Debian:13
 before 0.27.2-3
0.27.2-3
owslib
Debian:14
 before 0.27.2-3
0.27.2-3
owslib
Debian:10
 before 0.17.1-1+deb10u1, plus listed versions
0.17.1-1
0.17.1-1+deb10u1
owslib
Debian:11
 before 0.23.0-1+deb11u1, plus listed versions
0.23.0-1
0.23.0-1+deb11u1
owslib
PyPI
 before 0.28.1, plus listed versions
0.1.00.10.00.10.10.10.20.10.3
Show 45 moreShow less
0.11.00.11.10.11.20.12.00.13.00.14.00.15.00.16.00.17.00.17.10.18.00.19.00.19.10.19.20.2.00.2.10.20.00.21.00.22.00.23.00.24.00.24.10.25.00.26.00.27.00.27.10.27.20.28.00.30.3.10.4.00.5.00.5.10.6.00.6.10.7.00.7.10.7.20.8.00.8.10.8.100.8.110.8.120.8.130.8.2
0.28.1
python-owslib
Mageia:8
 before 0.28.1-1.mga8
0.28.1-1.mga8
owslib
Ubuntu:Pro:18.04:LTS
 before 0.16.0-1ubuntu0.1~esm1, plus listed versions
0.14.0-10.15.0-10.16.0-1
0.16.0-1ubuntu0.1~esm1
owslib
Ubuntu:Pro:20.04:LTS
 before 0.19.1-1ubuntu0.1~esm1, plus listed versions
0.18.0-10.18.0-20.19.0-10.19.1-1
0.19.1-1ubuntu0.1~esm1
owslib
Ubuntu:Pro:22.04:LTS
 before 0.25.0-1ubuntu0.1~esm1, plus listed versions
0.23.0-10.25.0-1
0.25.0-1ubuntu0.1~esm1
owslib
Ubuntu:Pro:16.04:LTS
 before 0.10.3-1ubuntu0.1~esm1, plus listed versions
0.9.0-10.9.2-10.10.0-10.10.3-1
0.10.3-1ubuntu0.1~esm1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-27476 is a high vulnerability (CVSS 8.2) in Geopython Owslib, published March 7, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in owslib 0.28.1.

References

Show 13 moreShow less
This page doesn't list everything

Left out here: 10 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open