PYSEC-2026-1221
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/biopython/PYSEC-2026-1221.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1221
- Aliases
- Published
- 2026-07-07T16:03:13.322865Z
- Modified
- 2026-07-07T17:47:32.617031538Z
- Severity
-
- 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L CVSS Calculator
- Summary
- Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez
- Details
-
Bio.Entrez in Biopython through 1.86 allows doctype XXE.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2025-68463
- https://github.com/biopython/biopython/issues/5109
- https://github.com/biopython/biopython/commit/736c96f37b190732ecca9da80ad0cb9d4967214d
- https://github.com/biopython/biopython
- https://github.com/biopython/biopython/blob/master/NEWS.rst
- https://pypi.org/project/biopython/1.87
- http://www.openwall.com/lists/oss-security/2026/05/08/16
- https://pypi.org/project/biopython
- https://github.com/advisories/GHSA-x3vf-39hj-gxr4
Affected packages
PyPI / biopython
Package
- Name
- biopython
- View open source insights on deps.dev
- Purl
- pkg:pypi/biopython
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.87
Affected versions
1.*
1.00a3
1.00a4
1.10
1.20
1.21
1.22
1.23
1.24
1.30
1.40b
1.41
1.42
1.43
1.44
1.45
1.46
1.47
1.48
1.49b
1.49
1.50b
1.50
1.51b
1.51
1.52
1.53
1.54b
1.54
1.55b
1.55
1.56
1.57
1.58
1.59
1.60
1.61
1.62b
1.62
1.63b
1.63
1.64
1.65
1.66
1.67
1.68
1.69
1.70
1.71
1.72
1.73
1.74
1.75
1.76
1.77
1.78
1.79
1.80
1.81
1.82
1.83
1.84
1.85
1.86