CVE-2025-9375 - CVE House
Back to Database
Status published Medium CVE-2025-9375

xmltodict 0.14.2 - XML Injection

Vulnerability Description

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9375

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Affected Software

xmltodict
Vulnerable Versions:
0.14.2

Timeline

Official Publish: September 1st, 2025
Last Modified: April 20th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-91

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.