-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from using Python's default xml.etree.ElementTree XML parser which doesn't restrict entity expansion by default. Both Client and AsyncClient classes contained a _parse_xml method that directly used xml.etree.ElementTree.fromstring() to parse untrusted XML input. The commit patched this by replacing the parser with defusedxml.ElementTree.fromstring(), which protects against entity expansion attacks. The vulnerable functions are clearly identified in the diff showing the XML parsing logic before patching.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mofh | pip | < 1.0.1 | 1.0.1 |
Ongoing coverage of React2Shell