{"id":"CVE-2020-26708","aliases":["EUVD-2023-0226","GHSA-ccrc-9x59-3vc4","PYSEC-2023-96"],"status":"published","title":"requests-xml XML External Entity Injection vulnerability","description":"requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00731,"percentile":0.54611,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2023-06-29T00:00:00Z","modified":"2026-10-20T10:52:58Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"requests-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.2.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"requests-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.2.3"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.2.3"]},{"source":"osv","ecosystem":"PyPI","package":"requests-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.2.3"]}],"products":[{"vendor":"requests-xml_project","product":"requests-xml"}],"references":[{"url":"https://github.com/erinxocon/requests-xml/issues/7","tags":["x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230908-0003/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26708","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests-xml/PYSEC-2023-96.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ccrc-9x59-3vc4","tags":["advisory"]},{"url":"https://github.com/erinxocon/requests-xml","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20230908-0003","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-26708","description":"requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.","status":"published","published":"2023-06-29T00:00:00Z","modified":"2024-11-27T14:41:47.661Z","updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2023-0226","description":"requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.","status":"published","published":"2023-06-29T00:00:00Z","modified":"2024-11-27T14:41:47Z","updated_at":"2026-11-03T00:04:46.096988Z"}],"ghsa":[{"id":"GHSA-ccrc-9x59-3vc4","title":"requests-xml XML External Entity Injection vulnerability","description":"requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.","status":"published","published":"2023-06-29T21:30:29Z","modified":"2023-11-07T05:03:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:15.055009Z"}],"nvd":[{"id":"CVE-2020-26708","description":"requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.","status":"published","published":"2023-06-29T21:15:09.197Z","modified":"2026-06-17T03:08:19.293Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:06:47.910346Z"}],"osv":[{"id":"CVE-2020-26708","description":"requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.","status":"published","published":"2023-06-29T21:15:09.197Z","modified":"2026-10-20T10:52:58.576301245Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"GHSA-ccrc-9x59-3vc4","title":"requests-xml XML External Entity Injection vulnerability","description":"requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.","status":"published","published":"2023-06-29T21:30:29Z","modified":"2024-02-22T05:42:50.363984Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"PYSEC-2023-96","description":"requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.","status":"published","published":"2023-06-29T21:15:00Z","modified":"2026-06-10T17:02:33.468793558Z","updated_at":"2026-11-02T15:52:53.837392Z"}]}}