XXE Vulnerability in Biopython's Bio.Entrez Component
CVE-2025-68463

4.9MEDIUM

Key Information:

Vendor

Biopython

Status
Biopython
Vendor
CVE Published:
18 December 2025

What is CVE-2025-68463?

An XML External Entity (XXE) vulnerability has been identified in Biopython's Bio.Entrez component, specifically affecting version 186. Exploitation of this vulnerability could allow an attacker to launch various attacks, such as data exfiltration or server-side request forgery. Users are urged to assess their implementation and consider upgrading to protected versions to mitigate these risks. For further details, refer to the official GitHub issue discussing this vulnerability.

Affected Version(s)

Biopython 0 <= 186

References

https://github.com/biopython/biopython/issues/5109

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-68463 : XXE Vulnerability in Biopython's Bio.Entrez Component