medium4.9
CVE-2025-68463
Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez
Impact
Bio.Entrez in Biopython through 1.86 allows doctype XXE.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | biopython | <= 1.86 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/biopython/biopython/blob/master/NEWS.rst
- https://github.com/biopython/biopython/commit/736c96f37b190732ecca9da80ad0cb9d4967214d
- https://github.com/biopython/biopython/issues/5109
- https://pypi.org/project/biopython/1.87/
- http://www.openwall.com/lists/oss-security/2026/05/08/16
- https://github.com/advisories/GHSA-x3vf-39hj-gxr4
- https://nvd.nist.gov/vuln/detail/CVE-2025-68463
- https://pypi.org/project/biopython/1.87