PyPI/biopython CVE-2025-68463: medium 4.9, EPSS 0.32%

Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

Action: Upgrade biopython to 1.87 or later.

pip install biopython==1.87

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1221
• https://nvd.nist.gov/vuln/detail/CVE-2025-68463
• https://github.com/biopython/biopython/issues/5109
• https://github.com/biopython/biopython/commit/736c96f37b190732ecca9da80ad0cb9d4967214d
• https://github.com/biopython/biopython
• https://github.com/biopython/biopython/blob/master/NEWS.rst
• https://pypi.org/project/biopython/1.87
• http://www.openwall.com/lists/oss-security/2026/05/08/16
• https://pypi.org/project/biopython
• https://github.com/advisories/GHSA-x3vf-39hj-gxr4

CVE-2025-68463 · published 2026-07-07T16:03:13.322865Z · modified 2026-07-07T17:47:32.617031538Z · JSON