{"id":"CVE-2025-9375","summary":"xmltodict 0.14.2 - XML Injection","details":"XML Injection vulnerability in xmltodict allows Input Data Manipulation.\nThis issue affects xmltodict: from 0.14.2 before 0.15.1.\n\nNOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.","modified":"2026-08-12T03:51:33.741791425Z","published":"2025-09-01T16:43:18.220Z","related":["SUSE-SU-2025:03457-1","SUSE-SU-2025:03511-1","openSUSE-SU-2025:15539-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9375.json","cna_assigner":"Fluid Attacks","cwe_ids":["CWE-91"],"isDisputed":true},"references":[{"type":"WEB","url":"https://docs.python.org/3/library/xml.sax.utils.html#xml.sax.saxutils.XMLGenerator"},{"type":"WEB","url":"https://docs.python.org/3/library/xml.sax.utils.html#xml.sax.saxutils.escape"},{"type":"WEB","url":"https://pypi.python.org"},{"type":"ADVISORY","url":"https://fluidattacks.com/advisories/mono"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9375.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9375"},{"type":"REPORT","url":"https://github.com/martinblech/xmltodict/issues/377#issuecomment-3255691923"},{"type":"FIX","url":"https://github.com/martinblech/xmltodict/blob/v0.15.1/CHANGELOG.md"},{"type":"FIX","url":"https://github.com/martinblech/xmltodict/commit/f98c90f071228ed73df997807298e1df4f790c33"},{"type":"PACKAGE","url":"https://github.com/martinblech/xmltodict"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/martinblech/xmltodict","events":[{"introduced":"0952f382c2340bc8b86a5503ba765a35a49cf7c4"},{"fixed":"75a17701db20d5d3ec2ea1f6c901cf2211011eb5"},{"fixed":"f98c90f071228ed73df997807298e1df4f790c33"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0.14.2"},{"fixed":"0.15.1"}]}}],"versions":["v0.15.0","v0.14.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9375.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}