{"id":"CVE-2025-68463","aliases":["DEBIAN-CVE-2025-68463","EUVD-2025-204037","GHSA-x3vf-39hj-gxr4","PYSEC-2026-1221","UBUNTU-CVE-2025-68463","openSUSE-SU-2026:10537-1","openSUSE-SU-2026:21169-1"],"status":"published","title":"Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez","description":"Bio.Entrez in Biopython through 186 allows doctype XXE.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00316,"percentile":0.24685,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2025-12-18T05:40:36Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"Debian:14","package":"python-biopython","fixed_in":["1.87+dfsg-1"],"sources":["osv"]},{"ecosystem":"PyPI","package":"biopython","fixed_in":["1.87"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-biopython","fixed_in":["1.87-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-biopython","fixed_in":["1.85-bp160.2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.86"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.80+dfsg-4","1.80+dfsg-5","1.80+dfsg-6","1.81+dfsg-0+exp1","1.81+dfsg-1","1.81+dfsg-2","1.81+dfsg-3","1.83+dfsg-1","1.83+dfsg1-1","1.83+dfsg1-2","1.83+dfsg1-3","1.83+dfsg1-4","1.83+dfsg1-5","1.84+dfsg-1","1.84+dfsg-1~0exp1","1.84+dfsg-2","1.84+dfsg-3","1.84+dfsg-4","1.85+dfsg-1","1.85+dfsg-2","1.85+dfsg-3","1.85+dfsg-4","1.85+dfsg-5","1.86+dfsg-1","1.87+dfsg-1","1.87+dfsg-2","1.87+dfsg-3","1.88+dfsg-1","1.88+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.85+dfsg-4","1.85+dfsg-5","1.86+dfsg-1","1.87+dfsg-1","1.87+dfsg-2","1.87+dfsg-3","1.88+dfsg-1","1.88+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.87+dfsg-1"}]}],"versions":["1.85+dfsg-4","1.85+dfsg-5","1.86+dfsg-1"]},{"source":"osv","ecosystem":"PyPI","package":"biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.86"}]}],"versions":["1.00a3","1.00a4","1.10","1.20","1.21","1.22","1.23","1.24","1.30","1.40b","1.41","1.42","1.43","1.44","1.45","1.46","1.47","1.48","1.49","1.49b","1.50","1.50b","1.51","1.51b","1.52","1.53","1.54","1.54b","1.55","1.55b","1.56","1.57","1.58","1.59","1.60","1.61","1.62","1.62b","1.63","1.63b","1.64","1.65","1.66","1.67","1.68","1.69","1.70","1.71","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.79","1.80","1.81","1.82","1.83","1.84","1.85","1.86"]},{"source":"osv","ecosystem":"PyPI","package":"biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.87"}]}],"versions":["1.00a3","1.00a4","1.10","1.20","1.21","1.22","1.23","1.24","1.30","1.40b","1.41","1.42","1.43","1.44","1.45","1.46","1.47","1.48","1.49","1.49b","1.50","1.50b","1.51","1.51b","1.52","1.53","1.54","1.54b","1.55","1.55b","1.56","1.57","1.58","1.59","1.60","1.61","1.62","1.62b","1.63","1.63b","1.64","1.65","1.66","1.67","1.68","1.69","1.70","1.71","1.72","1.73","1.74","1.75","1.76","1.77","1.78","1.79","1.80","1.81","1.82","1.83","1.84","1.85","1.86"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.65+dfsg-1","1.65+dfsg-3build1","1.66+dfsg-1","1.66+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.70+dfsg-2build1","1.70+dfsg-3","1.70+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.73+dfsg-1ubuntu1","1.73+dfsg-1ubuntu4","1.75+dfsg-4","1.76+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.78+dfsg-5ubuntu1","1.79+dfsg-1","1.79+dfsg-2","1.79+dfsg-2build1","1.79+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.81+dfsg-1","1.81+dfsg-2","1.81+dfsg-3","1.83+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.85+dfsg-2build1","1.85+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.86+dfsg-1ubuntu1","1.88+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.85+dfsg-4","1.86+dfsg-1","1.86+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.87-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-biopython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.85-bp160.2.1"}]}]}],"products":[{"vendor":"biopython","product":"biopython"}],"references":[{"url":"https://github.com/biopython/biopython/issues/5109","tags":["report","web"]},{"url":"https://pypi.org/project/biopython/1.87/","tags":["package"]},{"url":"https://github.com/biopython/biopython/blob/master/NEWS.rst","tags":["web"]},{"url":"https://github.com/biopython/biopython/commit/736c96f37b190732ecca9da80ad0cb9d4967214d","tags":["fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/08/16","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68463","tags":["advisory"]},{"url":"https://pypi.org/project/biopython/1.87","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x3vf-39hj-gxr4","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68463.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68463","tags":["advisory"]},{"url":"https://github.com/biopython/biopython","tags":["web"]},{"url":"https://pypi.org/project/biopython","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-68463","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68463","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68463","tags":["web"]},{"url":"https://bugzilla.suse.com/1255465","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-68463","description":"Bio.Entrez in Biopython through 186 allows doctype XXE.","status":"published","published":"2025-12-18T05:40:36.842Z","modified":"2026-05-08T18:28:47.889Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-204037","description":"Bio.Entrez in Biopython through 186 allows doctype XXE.","status":"published","published":"2025-12-18T05:40:36Z","modified":"2026-05-08T18:28:47Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:05:14.089367Z"}],"ghsa":[{"id":"GHSA-x3vf-39hj-gxr4","title":"Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez","description":"Bio.Entrez in Biopython through 1.86 allows doctype XXE.","status":"published","published":"2025-12-18T06:30:13Z","modified":"2026-05-12T13:38:35Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:40:07.01746Z"}],"nvd":[{"id":"CVE-2025-68463","description":"Bio.Entrez in Biopython through 186 allows doctype XXE.","status":"published","published":"2025-12-18T06:15:50.177Z","modified":"2026-10-13T11:10:00.203Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:11:51.309584Z"}],"osv":[{"id":"CVE-2025-68463","description":"Bio.Entrez in Biopython through 186 allows doctype XXE.","status":"published","published":"2025-12-18T05:40:36.842Z","modified":"2026-10-28T02:30:44.014890393Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"DEBIAN-CVE-2025-68463","description":"Bio.Entrez in Biopython through 186 allows doctype XXE.","status":"published","published":"2025-12-18T06:15:50.177Z","modified":"2026-10-14T09:47:33.443729885Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"GHSA-x3vf-39hj-gxr4","title":"Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez","description":"Bio.Entrez in Biopython through 1.86 allows doctype XXE.","status":"published","published":"2025-12-18T06:30:13Z","modified":"2026-07-07T17:56:50.04707159Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"PYSEC-2026-1221","title":"Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez","description":"Bio.Entrez in Biopython through 1.86 allows doctype XXE.","status":"published","published":"2026-07-07T16:03:13.322865Z","modified":"2026-07-07T17:47:32.617031538Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"UBUNTU-CVE-2025-68463","description":"Bio.Entrez in Biopython through 186 allows doctype XXE.","status":"published","published":"2025-12-18T06:15:00Z","modified":"2026-10-17T12:57:30.450006066Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"openSUSE-SU-2026:10537-1","title":"python311-biopython-1.87-1.1 on GA media","description":"These are all security issues fixed in the python311-biopython-1.87-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-12T00:00:00Z","modified":"2026-04-13T07:45:11.145149Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21169-1","title":"Security update for python-biopython","description":"This update for python-biopython fixes the following issues:\n\nChanges in python-biopython:\n\n- CVE-2025-68463: Fixed a information disclosure caused by a XXE vulnerability (boo#1255465).\n","status":"published","published":"2026-06-29T08:28:18Z","modified":"2026-06-30T09:15:07.735172027Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}