Improper Restriction of XML External Entity Reference in pikepdf

ALTO 7.5CVE-2021-29421 · GHSA-ccgm-3xw4-h5p8 · PYSEC-2021-34 · Published 01/04/2021 · updated 17/06/2026

In breve

CVE-2021-29421 è una vulnerabilità ALTO (CVSS 7.5) che riguarda pikepdf, pikepdf (pikepdf project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.7%, superiore al 77.1% delle vulnerabilità.
Correzione: aggiornare a 2.10.0 o successiva.

Package	Affected versions	Patched versions
pikepdf PyPI	`≥ 1.3.0, < 2.10.0`	`2.10.0`
pikepdf pikepdf_project	`≥ 1.3.0, ≤ 2.9.2`	No fix yet

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.

NVD description

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.