-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 1.3.0, < 1.3.6 | 1.3.6 |
| Django | pip | >= 1.4.0, < 1.4.4 | 1.4.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Django's XML deserializer not restricting entity processing. The commit 1c60d07 introduces DefusedExpatParser to harden parsing, indicating the original code lacked these safeguards. The Deserializer's init method invoked pulldom.parse with the default (insecure) ExpatParser, making it vulnerable to XEE. The patch replaces this with a custom parser that blocks dangerous XML features, confirming the original functions' vulnerability.