CVE-2025-68463

Published: Dec 18, 2025Modified: Jun 17, 2026Deferred

4.9

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L

Exploitability: 1.8 / Impact: 2.7

Source: MITRE (Secondary)

Description

Bio.Entrez in Biopython through 186 allows doctype XXE.

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (5)

https://github.com/biopython/biopython/blob/master/NEWS.rst

Source: cve@mitre.org

https://github.com/biopython/biopython/commit/736c96f37b190732ecca9da80ad0cb9d4967214d

Source: cve@mitre.org

https://github.com/biopython/biopython/issues/5109

Source: cve@mitre.org

https://pypi.org/project/biopython/1.87/

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2026/05/08/16

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.