Every CVE Search/ Get API key

CVE-2025-9375

xmltodict 0.14.2 - XML Injection

6.9 MediumFix availableDisputed

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1.

NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.46%Up 0.4 points since Sep 2, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.9

xmltodict 0.14.2 - XML Injection

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1.

NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Record
CVE-2025-9375
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-91
Updated
2026-11-02
EUVDEUVD-2025-26350 6.9

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1.

NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Record
EUVD-2025-26350
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-rqvm-6hhw-247j 6.9

XML Injection vulnerability in xmltodict allows Input Data Manipulation.This issue affects...

XML Injection vulnerability in xmltodict allows Input Data Manipulation.This issue affects xmltodict: 0.14.2.

Record
GHSA-rqvm-6hhw-247j
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-91
Updated
2026-11-02
NVD 6.9

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1.

NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Record
CVE-2025-9375
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-91
Updated
2026-11-02
OSV 6.9

xmltodict 0.14.2 - XML Injection

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1.

NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Record
CVE-2025-9375
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-91
Updated
2026-11-02
OSVDEBIAN-CVE-2025-9375 6.9

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Record
DEBIAN-CVE-2025-9375
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2025-2336 5.3

python-xmltodict security update

Python module that makes working with XML feel like you are working with JSON

Security Fix(es):

XML Injection vulnerability in xmltodict allows Input Data Manipulation.This issue affects xmltodict: 0.14.2.(CVE-2025-9375)

Record
OESA-2025-2336
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-9375 6.9

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Record
UBUNTU-CVE-2025-9375
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVopenSUSE-SU-2025:15539-1 No score

python311-xmltodict-0.15.1-1.1 on GA media

These are all security issues fixed in the python311-xmltodict-0.15.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15539-1
Updated
2026-11-02
OSVSUSE-SU-2025:03457-1 No score

Security update for python-xmltodict

This update for python-xmltodict fixes the following issues:

  • CVE-2025-9375: XML injection vulnerability in xmltodict allows input data manipulation (bsc#1249036).
Record
SUSE-SU-2025:03457-1
Updated
2026-11-02
OSVSUSE-SU-2025:03511-1 No score

Security update for python-xmltodict

This update for python-xmltodict fixes the following issues:

  • CVE-2025-9375: XML injection vulnerability in xmltodict allows input data manipulation (bsc#1249036).
Record
SUSE-SU-2025:03511-1
Updated
2026-11-02
OSVUSN-7753-1 No score

python-xmltodict vulnerability

Camilo Vera discovered that xmltodict parsed maliciously crafted XML input, contrary to expectations. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or execute arbitrary code.

Record
USN-7753-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-xmltodict
Debian:12
 before 0.13.0-1.1~deb12u1, plus listed versions
0.13.0-1
0.13.0-1.1~deb12u1
python-xmltodict
Debian:13
 before 0.13.0-1.1~deb13u1, plus listed versions
0.13.0-10.13.0-1.1~deb12u1
0.13.0-1.1~deb13u1
python-xmltodict
Debian:14
 before 0.13.0-1.1, plus listed versions
0.13.0-10.13.0-1.1~deb12u10.13.0-1.1~deb13u1
0.13.0-1.1
python-xmltodict
openEuler:24.03-LTS-SP2
 before 1.0.0-1.oe2403sp2
1.0.0-1.oe2403sp2
python-xmltodict
openEuler:20.03-LTS-SP4
 before 1.0.0-1.oe2003sp4
1.0.0-1.oe2003sp4
python-xmltodict
openEuler:22.03-LTS-SP3
 before 1.0.0-1.oe2203sp3
1.0.0-1.oe2203sp3
python-xmltodict
openEuler:22.03-LTS-SP4
 before 1.0.0-1.oe2203sp4
1.0.0-1.oe2203sp4
python-xmltodict
openEuler:24.03-LTS
 before 1.0.0-1.oe2403sp1
1.0.0-1.oe2403sp1
python-xmltodict
openEuler:24.03-LTS-SP1
 before 1.0.0-1.oe2403sp1
1.0.0-1.oe2403sp1
python-xmltodict
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 0.13.0-150400.12.7.1
0.13.0-150400.12.7.1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
python-xmltodict
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 0.13.0-150400.12.7.1
0.13.0-150400.12.7.1
python-xmltodict
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
 before 0.13.0-150600.3.5.1
0.13.0-150600.3.5.1
python-xmltodict
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
 before 0.13.0-150600.3.5.1
0.13.0-150600.3.5.1
python-xmltodict
openSUSE:Leap 15.6
 before 0.13.0-150600.3.5.1
0.13.0-150600.3.5.1
python-xmltodict
Ubuntu:Pro:16.04:LTS
 before 0.9.2-3ubuntu0.1~esm1, plus listed versions
0.9.2-3
0.9.2-3ubuntu0.1~esm1
python-xmltodict
Ubuntu:Pro:18.04:LTS
 before 0.11.0-1ubuntu0.1~esm1, plus listed versions
0.11.0-1
0.11.0-1ubuntu0.1~esm1
python-xmltodict
Ubuntu:Pro:20.04:LTS
 before 0.12.0-1ubuntu0.1~esm1, plus listed versions
0.11.0-20.11.0-2build10.12.0-1
0.12.0-1ubuntu0.1~esm1
python-xmltodict
Ubuntu:Pro:22.04:LTS
 before 0.12.0-2ubuntu0.1~esm1, plus listed versions
0.12.0-2
0.12.0-2ubuntu0.1~esm1
python-xmltodict
Ubuntu:24.04:LTS
 before 0.13.0-1ubuntu0.24.04.1, plus listed versions
0.13.0-1
0.13.0-1ubuntu0.24.04.1
python-xmltodict
Ubuntu:25.10
 before 0.13.0-1ubuntu1, plus listed versions
0.13.0-1
0.13.0-1ubuntu1
python-xmltodict
Ubuntu:26.04:LTS
 before 0.13.0-1ubuntu1
0.13.0-1ubuntu1
python-xmltodict
openSUSE:Tumbleweed
 before 0.15.1-1.1
0.15.1-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-9375 is a medium vulnerability (CVSS 6.9) in Xmltodict, published September 1, 2025. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in python-xmltodict 0.13.0-1.1~deb12u1.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open