XML External Entity (XXE) Injection in OWSLib
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| geopython | OWSLib | before 0.28.1 | 0.28.1 | Patch available | CNA |
| — | OWSLib (PyPI) | before 0.28.1 | 0.28.1 | Patch available | GHSA-8h9c-r582-mggc |
- OWSLib Vendorgeopython Affected before 0.28.1 Fixed in 0.28.1 Patch available CNA
- OWSLib (PyPI) Vendor— Affected before 0.28.1 Fixed in 0.28.1 Patch available GHSA-8h9c-r582-mggc
Remediation
- Fix · CNA OWSLib (geopython) Fixed in 0.28.1
- Fix · GHSA-8h9c-r582-mggc OWSLib (PyPI) Fixed in 0.28.1 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-27476
- 2026-10-03 Alias added: GHSA-8h9c-r582-mggc
References
Patch 1
Advisory 3
Other 7
- https://securitylab.github.com/advisories/GHSL-2022-131_owslib/
- https://www.debian.org/security/2023/dsa-5426
- https://lists.debian.org/debian-lts-announce/2023/06/msg00032.html
- https://github.com/geopython/OWSLib/pull/863
- https://github.com/geopython/OWSLib
- https://github.com/geopython/OWSLib/releases/tag/0.28.1
- https://github.com/pypa/advisory-database/tree/main/vulns/owslib/PYSEC-2023-86.yaml
More geopython vulnerabilities
- TI-2026-30654 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber CVSS 3.1HIGH 8.6
- TI-2026-30653 pygeoapi: Path Traversal in STAC FileSystemProvider CVSS 3.1HIGH 7.5
Sources
- CVE-2023-27476 · CVE Program
- CVE-2023-27476 · NVD
- FIRST EPSS
- GHSA-8h9c-r582-mggc · GitHub Advisory Database · CC BY 4.0
- CVE-2023-27476 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences