MEDIUM6.1

PYSEC-2026-627

XML External Entities Vulnerability in CVRF-CSAF-Converter

Quick fix

PYSEC-2026-627 — cvrf2csaf: upgrade to the fixed version with the command below.

pip install --upgrade 'cvrf2csaf>=1.0.0rc2'

Details

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/cvrf2csaf

Introduced in: 0Fixed in: 1.0.0rc2

Fixpip install --upgrade 'cvrf2csaf>=1.0.0rc2'

References

https://nvd.nist.gov/vuln/detail/CVE-2022-27193[ADVISORY]
https://github.com/csaf-tools/CVRF-CSAF-Converter[PACKAGE]
https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2[WEB]
https://pypi.org/project/cvrf2csaf[PACKAGE]
https://github.com/advisories/GHSA-m8gq-83gh-v42v[ADVISORY]