Log in Start free

Vulnerability · Published Sep 1, 2025 · Assigned by Fluid Attacks

CVE-2025-9375xmltodict 0.14.2 - XML Injection

Medium 6.9

In plain English

A medium-severity security flaw in xmltodict from xmltodict. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.5%top 59.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-xmltodict0.13.0-1.1~deb12u1DEBIAN-CVE-2025-9375
Debian:13python-xmltodict0.13.0-1.1~deb13u1DEBIAN-CVE-2025-9375
Debian:14python-xmltodict0.13.0-1.1DEBIAN-CVE-2025-9375
Ubuntu:24.04:LTSpython-xmltodict0.13.0-1ubuntu0.24.04.1USN-7753-1
Ubuntu:24.04:LTSpython-xmltodict0.13.0-1ubuntu0.24.04.1UBUNTU-CVE-2025-9375
Ubuntu:25.10python-xmltodict0.13.0-1ubuntu1UBUNTU-CVE-2025-9375
Ubuntu:26.04:LTSpython-xmltodict0.13.0-1ubuntu1UBUNTU-CVE-2025-9375

Affected products (as reported)

VendorProductVersions
xmltodict xmltodict 0.14.2 – before 0.15.1

Weakness: CWE-91 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References