{"action":"Upgrade python-docx to 0.8.6 or later.","affected":[{"fixed":"0.8.6","introduced":"0"}],"component":"python-docx","cve_ids":["CVE-2016-5851"],"ecosystem":"PyPI","epss":0.02354,"exploited":false,"fixed_versions":["0.8.6"],"ghsa_id":"GHSA-34wj-p5jm-2p96","id":"tcs_01M5KG6TRSHZM7BAS2T5TQV1TK","modified_at":"2023-11-08T03:58:32.000630Z","published_at":"2016-12-21T22:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2016-21","https://github.com/python-openxml/python-docx/blob/v0.8.6/HISTORY.rst","http://www.securityfocus.com/bid/91485","http://www.openwall.com/lists/oss-security/2016/06/28/8","http://www.openwall.com/lists/oss-security/2016/06/28/7","https://github.com/advisories/GHSA-34wj-p5jm-2p96"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2016-21","url":"https://osv.dev/vulnerability/PYSEC-2016-21"}],"summary":"python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document."}