An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
CVSS 3.1CRITICAL 9.1·Network·No auth·No interaction·EPSS 0.00536·Published 2024-06-07·Fixed in 1.2.8CWE-611
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
CVSS 3.1HIGH 7.5·Network·No auth·No interaction·EPSS 0.00498·Published 2024-06-07·Fixed in 1.2.8CWE-611