CVE-2025-9375

NameCVE-2025-9375
DescriptionXML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1113825

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-xmltodict (PTS)bullseye0.12.0-2vulnerable
forky, sid, bookworm, trixie0.13.0-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-xmltodictsource(unstable)(unfixed)1113825

Notes

[trixie] - python-xmltodict <no-dsa> (Minor issue)
[bookworm] - python-xmltodict <no-dsa> (Minor issue)
[bullseye] - python-xmltodict <postponed> (Minor issue)
https://github.com/martinblech/xmltodict/issues/377
https://fluidattacks.com/advisories/mono
https://github.com/martinblech/xmltodict/commit/ecd456ab88d379514b116ef9293318b74e5ed3ee (v0.15.0)
https://github.com/martinblech/xmltodict/commit/f98c90f071228ed73df997807298e1df4f790c33 (v0.15.1)

Search for package or bug name: Reporting problems