{"action":"Upgrade mpxj to 16.4.1 or later.","affected":[{"fixed":"16.4.1","introduced":"5.5.5"}],"component":"mpxj","cve_ids":["CVE-2026-61570"],"ecosystem":"PyPI","epss":0.00474,"exploited":false,"fixed_versions":["16.4.1"],"ghsa_id":"GHSA-5vvx-3h34-f3gj","id":"tcs_01M5KEH4MQ4J3K420M26B7E0BV","modified_at":"2026-10-01T17:56:18.001807322Z","published_at":"2026-09-22T20:34:25Z","references":["https://osv.dev/vulnerability/GHSA-5vvx-3h34-f3gj","https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj","https://github.com/joniles/mpxj/commit/6e8288bc4d1cd62842af298004dc74fe66fb0805","https://github.com/joniles/mpxj","https://github.com/joniles/mpxj/releases/tag/v16.4.1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-5vvx-3h34-f3gj#PyPI/mpxj","url":"https://osv.dev/vulnerability/GHSA-5vvx-3h34-f3gj"}],"summary":"MPXJ: XXE Vulnerability in MerlinReader"}