Improper Restriction of XML External Entity Reference in Openpyxl

HOCH 8.2CVE-2017-5992 · GHSA-chqf-hx79-gxc6 · PYSEC-2017-48 · Published 15/02/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
openpyxl PyPI	`< 2.4.1< 2.4.2`	`2.4.12.4.2`
openpyxl python	`= 2.4.1`	No fix yet

Description

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.

NVD description

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.