CVE-2025-9375

Description

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

Is your site exposed to CVE-2025-9375?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-91 CWE-91

References

Other References

https://fluidattacks.com/advisories/mono https://github.com/martinblech/xmltodict https://github.com/martinblech/xmltodict/blob/v0.15.1/CHANGELOG.md https://github.com/martinblech/xmltodict/commit/f98c90f071228ed73df997807298e1df4f790c33 https://docs.python.org/3/library/xml.sax.utils.html#xml.sax.saxutils.XMLGenerator https://docs.python.org/3/library/xml.sax.utils.html#xml.sax.saxutils.escape https://github.com/martinblech/xmltodict/issues/377#issuecomment-3255691923

Frequently Asked Questions

What is CVE-2025-9375? +

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

How do I check if I'm vulnerable to CVE-2025-9375? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions …

CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, …

CVE-2026-41672

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to …

CVE-2026-41675

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to …

CVE-2026-41674

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to …

CVE-2026-48590

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program files …

CVE-2025-9375

Description

Weakness Type (CWE)

References

Other References

Frequently Asked Questions

Related Vulnerabilities

Don't wait for an exploit