CVE-2025-9375 xmltodict 0.14.2 - XML Injection
An XML injection vulnerability in xmltodict allows attackers to manipulate input data, potentially leading to information disclosure or service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9375?
CVE-2025-9375 is a medium-severity vulnerability in xmltodict, published on 1 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1.
NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.
Weakness: CWE-91
Which versions are affected by CVE-2025-9375?
Linux distribution packages (6)
python-xmltodict SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 0.13.0-150400.12.7.1 |
python-xmltodict SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 0.13.0-150400.12.7.1 |
python-xmltodict SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 0.13.0-150600.3.5.1 |
python-xmltodict SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | All versions | 0.13.0-150600.3.5.1 |
python-xmltodict openSUSE:Leap 15.6 | All versions | 0.13.0-150600.3.5.1 |
python-xmltodict openSUSE:Tumbleweed | All versions | 0.15.1-1.1 |
How do I fix CVE-2025-9375?
Upgrade to a fixed version.
Is CVE-2025-9375 being exploited?
There is no known exploitation of CVE-2025-9375 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-9375, ECHO-cf28-0eb1-0db4, GHSA-rqvm-6hhw-247j, OESA-2025-2336, SUSE-SU-2025:03457-1, SUSE-SU-2025:03511-1 and 3 more.