CVE-2025-68463

Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

4.9 MediumFix available

Bio.Entrez in Biopython through 186 allows doctype XXE.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: Low

Exploit likelihood

0.32%Up 0.3 points since Dec 18, 2025

What each source reports

CVE List Score used 4.9

Bio.Entrez in Biopython through 186 allows doctype XXE.

Record: CVE-2025-68463
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
Weakness: CWE-611
Updated: 2026-11-02

EUVDEUVD-2025-204037 4.9

Bio.Entrez in Biopython through 186 allows doctype XXE.

Record: EUVD-2025-204037
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-x3vf-39hj-gxr4 4.9

Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

Bio.Entrez in Biopython through 1.86 allows doctype XXE.

Record: GHSA-x3vf-39hj-gxr4
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
Weakness: CWE-611
Updated: 2026-11-02

NVD 4.9

Bio.Entrez in Biopython through 186 allows doctype XXE.

Record: CVE-2025-68463
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
Weakness: CWE-611
Updated: 2026-11-02

OSV 4.9

Bio.Entrez in Biopython through 186 allows doctype XXE.

Record: CVE-2025-68463
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
Weakness: CWE-611
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-68463 4.9

Bio.Entrez in Biopython through 186 allows doctype XXE.

Record: DEBIAN-CVE-2025-68463
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
Updated: 2026-11-02

Show 5 moreShow less

OSVGHSA-x3vf-39hj-gxr4 4.9

Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

Bio.Entrez in Biopython through 1.86 allows doctype XXE.

Record: GHSA-x3vf-39hj-gxr4
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
Weakness: CWE-611
Updated: 2026-11-02

OSVPYSEC-2026-1221 4.9

Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

Bio.Entrez in Biopython through 1.86 allows doctype XXE.

Record: PYSEC-2026-1221
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-68463 4.9

Bio.Entrez in Biopython through 186 allows doctype XXE.

Record: UBUNTU-CVE-2025-68463
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10537-1 No score

python311-biopython-1.87-1.1 on GA media

These are all security issues fixed in the python311-biopython-1.87-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10537-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21169-1 No score

Security update for python-biopython

This update for python-biopython fixes the following issues:

Changes in python-biopython:

CVE-2025-68463: Fixed a information disclosure caused by a XXE vulnerability (boo#1255465).

Record: openSUSE-SU-2026:21169-1
Updated: 2026-11-02

Affected products

biopython

Affected packages

Affected packages
Package	Affected	Fixed
`biopython` PyPI	through 1.86	None known
`python-biopython` Debian:12	All versions, plus listed versions 1.80+dfsg-41.80+dfsg-51.80+dfsg-61.81+dfsg-0+exp11.81+dfsg-1 Show 24 moreShow less 1.81+dfsg-21.81+dfsg-31.83+dfsg-11.83+dfsg1-11.83+dfsg1-21.83+dfsg1-31.83+dfsg1-41.83+dfsg1-51.84+dfsg-11.84+dfsg-1~0exp11.84+dfsg-21.84+dfsg-31.84+dfsg-41.85+dfsg-11.85+dfsg-21.85+dfsg-31.85+dfsg-41.85+dfsg-51.86+dfsg-11.87+dfsg-11.87+dfsg-21.87+dfsg-31.88+dfsg-11.88+dfsg-2	None known
`python-biopython` Debian:13	All versions, plus listed versions 1.85+dfsg-41.85+dfsg-51.86+dfsg-11.87+dfsg-11.87+dfsg-21.87+dfsg-31.88+dfsg-11.88+dfsg-2	None known
`python-biopython` Debian:14	before 1.87+dfsg-1, plus listed versions 1.85+dfsg-41.85+dfsg-51.86+dfsg-1	1.87+dfsg-1
`biopython` PyPI	through 1.86, plus listed versions 1.00a31.00a41.101.201.21 Show 45 moreShow less 1.221.231.241.301.40b1.411.421.431.441.451.461.471.481.491.49b1.501.50b1.511.51b1.521.531.541.54b1.551.55b1.561.571.581.591.601.611.621.62b1.631.63b1.641.651.661.671.681.691.701.711.721.73	None known
`biopython` PyPI	before 1.87, plus listed versions 1.00a31.00a41.101.201.21 Show 45 moreShow less 1.221.231.241.301.40b1.411.421.431.441.451.461.471.481.491.49b1.501.50b1.511.51b1.521.531.541.54b1.551.55b1.561.571.581.591.601.611.621.62b1.631.63b1.641.651.661.671.681.691.701.711.721.73	1.87
`python-biopython` Ubuntu:16.04:LTS	All versions, plus listed versions 1.65+dfsg-11.65+dfsg-3build11.66+dfsg-11.66+dfsg-1build1	None known
`python-biopython` Ubuntu:18.04:LTS	All versions, plus listed versions 1.70+dfsg-2build11.70+dfsg-31.70+dfsg-4	None known
`python-biopython` Ubuntu:20.04:LTS	All versions, plus listed versions 1.73+dfsg-1ubuntu11.73+dfsg-1ubuntu41.75+dfsg-41.76+dfsg-1	None known
`python-biopython` Ubuntu:22.04:LTS	All versions, plus listed versions 1.78+dfsg-5ubuntu11.79+dfsg-11.79+dfsg-21.79+dfsg-2build11.79+dfsg-3	None known

Show 6 moreShow less

Affected packages
Package	Affected	Fixed
`python-biopython` Ubuntu:24.04:LTS	All versions, plus listed versions 1.81+dfsg-11.81+dfsg-21.81+dfsg-31.83+dfsg1-1	None known
`python-biopython` Ubuntu:25.10	All versions, plus listed versions 1.85+dfsg-2build11.85+dfsg-4	None known
`python-biopython` Ubuntu:26.10	All versions, plus listed versions 1.86+dfsg-1ubuntu11.88+dfsg-1	None known
`python-biopython` Ubuntu:26.04:LTS	All versions, plus listed versions 1.85+dfsg-41.86+dfsg-11.86+dfsg-1ubuntu1	None known
`python-biopython` openSUSE:Tumbleweed	before 1.87-1.1	1.87-1.1
`python-biopython` openSUSE:Leap 16.0	before 1.85-bp160.2.1	1.85-bp160.2.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-68463 is a medium vulnerability (CVSS 4.9) in Biopython, published December 18, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in python-biopython 1.87+dfsg-1.

References

Show 9 moreShow less

This page doesn't list everything

Left out here: 25 versions. The JSON record has them.