CVE-2025-9375

Katalog CVE

CVSS 6.9 · Medium EPSS 0,45%

Kerentanan XML Injection (aka Blind XPath Injection). Skor CVSS 4.0 6.9 (Medium) menurut fluidattacks.com.

Deskripsi (NVD)

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Rincian

Terbit di NVD

1 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

6.9 (Medium), sumber fluidattacks.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-91: XML Injection (aka Blind XPath Injection)

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://fluidattacks.com/advisories/mono
• https://github.com/martinblech/xmltodict
• https://github.com/martinblech/xmltodict/blob/v0.15.1/CHANGELOG.md
• https://github.com/martinblech/xmltodict/commit/f98c90f071228ed73df997807298e1df4f790c33
• https://docs.python.org/3/library/xml.sax.utils.html#xml.sax.saxutils.XMLGenerator
• https://docs.python.org/3/library/xml.sax.utils.html#xml.sax.saxutils.escape
• https://github.com/martinblech/xmltodict/issues/377#issuecomment-3255691923