PyPI/biopython CVE-2025-68463: medium 4.9, EPSS 0.32%
Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.86 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-x3vf-39hj-gxr4
- https://nvd.nist.gov/vuln/detail/CVE-2025-68463
- https://github.com/biopython/biopython/issues/5109
- https://github.com/biopython/biopython/commit/736c96f37b190732ecca9da80ad0cb9d4967214d
- https://github.com/biopython/biopython
- https://github.com/biopython/biopython/blob/master/NEWS.rst
- https://pypi.org/project/biopython/1.87
- http://www.openwall.com/lists/oss-security/2026/05/08/16
CVE-2025-68463 · published · modified · JSON