{"id":"CVE-2021-29421","aliases":["ALPINE-CVE-2021-29421","DEBIAN-CVE-2021-29421","EUVD-2021-0166","GHSA-ccgm-3xw4-h5p8","MGASA-2021-0268","PYSEC-2021-34","UBUNTU-CVE-2021-29421","openSUSE-SU-2024:11250-1","openSUSE-SU-2024:13864-1","openSUSE-SU-2026:11355-1"],"status":"published","title":"Improper Restriction of XML External Entity Reference in pikepdf","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01681,"percentile":0.77281,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2021-04-01T00:00:00Z","modified":"2026-11-03T06:32:38Z","fixes":[{"ecosystem":"PyPI","package":"pikepdf","fixed_in":["2.10.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-pikepdf","fixed_in":["2.9.1-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pikepdf","fixed_in":["1.17.3+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pikepdf","fixed_in":["1.17.3+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pikepdf","fixed_in":["1.17.3+dfsg-5"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-pikepdf","fixed_in":["2.10.0-1.mga8"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-pikepdf","fixed_in":["10.5.1-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"2.10.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3+dfsg-5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"2.10.0"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.11.2","1.12.0","1.13.0","1.14.0","1.15.0","1.15.1","1.16.0","1.16.1","1.17.0","1.17.1","1.17.2","1.17.3","1.18.0","1.19.0","1.19.1","1.19.2","1.19.3","1.19.4","1.3.0","1.3.1","1.4.0","1.5.0.post0","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.8.3","1.9.0","2.0.0","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.0.post2","2.9.0","2.9.1","2.9.2"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-1.mga8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pikepdf","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"3f38f73218e5e782fe411ccbb3b44a793c0b343a"}]},{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"2.10.0"}]}],"versions":["1.3.0","1.3.1","1.4.0","1.5.0","1.5.0.post0","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.8.3","1.9.0","1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.11.2","1.12.0","1.13.0","1.14.0","1.15.0","1.15.1","1.16.0","1.16.1","1.17.0","1.17.1","1.17.2","1.17.3","1.18.0","1.19.0","1.19.1","1.19.2","1.19.3","1.19.4","2.0.0b1","2.0.0b2","2.0.0","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.7.0","2.8.0","2.8.0.post1","2.8.0.post2","2.9.0","2.9.1","2.9.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.4+dfsg-1","1.6.4+dfsg-1build1","1.6.5+dfsg-1","1.7.0+dfsg-1","1.8.1+dfsg-1","1.10.0+dfsg-1build1","1.10.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.3+dfsg-5ubuntu1","3.2.0+dfsg-2","4.2.0+dfsg-1","5.0.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3.2+dfsg-1","8.5.1+dfsg-1","8.5.1+dfsg-1build1","8.7.1+dfsg-2","8.7.1+dfsg-2build1","8.7.1+dfsg-2build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.5.2+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.3.0+dfsg-1build1","10.5.0+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.5.2+dfsg-1build2","9.5.2+dfsg-1build3","10.2.0+dfsg-1","10.3.0+dfsg-1","10.3.0+dfsg-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pikepdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.1-2.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"pikepdf_project","product":"pikepdf"}],"references":[{"url":"https://github.com/pikepdf/pikepdf/commit/3f38f73218e5e782fe411ccbb3b44a793c0b343a","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QFLBBYGEDNXJ7FS6PIWTVI4T4BUPGEQ/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36P4HTLBJPO524WMQWW57N3QRF4RFSJG/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://github.com/pikepdf/pikepdf/blob/v2.10.0/docs/release_notes.rst#v2100","tags":["x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29421","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ccgm-3xw4-h5p8","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pikepdf/PYSEC-2021-34.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36P4HTLBJPO524WMQWW57N3QRF4RFSJG","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QFLBBYGEDNXJ7FS6PIWTVI4T4BUPGEQ","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-29421","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-29421","tags":["advisory"]},{"url":"https://github.com/pikepdf/pikepdf","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0268.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29022","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QFLBBYGEDNXJ7FS6PIWTVI4T4BUPGEQ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36P4HTLBJPO524WMQWW57N3QRF4RFSJG/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-29421","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29421","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29421","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-29421","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","status":"published","published":"2021-04-01T00:00:00Z","modified":"2024-08-03T22:02:51.995Z","updated_at":"2026-11-02T14:33:06.32268Z"}],"euvd":[{"id":"EUVD-2021-0166","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","status":"published","published":"2021-04-01T00:00:00Z","modified":"2024-08-03T22:02:51Z","updated_at":"2026-11-03T03:24:45.541615Z"}],"ghsa":[{"id":"GHSA-ccgm-3xw4-h5p8","title":"Improper Restriction of XML External Entity Reference in pikepdf","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","status":"published","published":"2021-04-20T16:30:03Z","modified":"2024-10-09T19:51:43Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2021-29421","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","status":"published","published":"2021-04-01T20:15:12.453Z","modified":"2026-06-17T03:47:36.3Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:06:51.197859Z"}],"osv":[{"id":"ALPINE-CVE-2021-29421","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","status":"published","published":"2021-04-01T20:15:12.453Z","modified":"2026-11-03T06:32:38.766488133Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2021-29421","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","status":"published","published":"2021-04-01T20:15:12.453Z","modified":"2026-10-20T10:54:39.454746832Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-29421","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","status":"published","published":"2021-04-01T20:15:12.453Z","modified":"2026-10-23T18:02:30.618019341Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-ccgm-3xw4-h5p8","title":"Improper Restriction of XML External Entity Reference in pikepdf","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","status":"published","published":"2021-04-20T16:30:03Z","modified":"2026-09-10T03:49:03.241318694Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"UBUNTU-CVE-2021-29421","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","status":"published","published":"2021-04-01T20:15:00Z","modified":"2026-10-17T12:57:13.396799624Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"MGASA-2021-0268","title":"Updated python-pikepdf packages fix security vulnerability","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python\nallows XXE when parsing XMP metadata entries (CVE-2021-29421).\n","status":"published","published":"2021-06-18T19:24:28Z","modified":"2026-04-16T04:42:59.420211525Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:11250-1","title":"python36-pikepdf-2.12.1-1.3 on GA media","description":"These are all security issues fixed in the python36-pikepdf-2.12.1-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:30.479186Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13864-1","title":"python310-pikepdf-8.15.0-1.1 on GA media","description":"These are all security issues fixed in the python310-pikepdf-8.15.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:34.312536Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11355-1","title":"python313-pikepdf-10.5.1-2.1 on GA media","description":"These are all security issues fixed in the python313-pikepdf-10.5.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-23T00:00:00Z","modified":"2026-07-24T17:16:09.186438563Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"PYSEC-2021-34","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","status":"published","published":"2021-04-01T20:15:00Z","modified":"2023-11-08T04:05:33.3479Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}