{"action":"Upgrade vtk to 9.0.1 or later.","affected":[{"fixed":"9.0.1","introduced":"0"}],"component":"vtk","cve_ids":["CVE-2021-42521"],"ecosystem":"PyPI","epss":0.01316,"exploited":false,"fixed_versions":["9.0.1"],"ghsa_id":"GHSA-xfhg-9pjg-xg7g","id":"tcs_01M5KGGT16CHZE414TRE7V1WS4","modified_at":"2023-11-08T04:07:06.578141Z","published_at":"2022-08-25T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-255","https://gitlab.kitware.com/vtk/vtk/issues/17818","https://github.com/advisories/GHSA-xfhg-9pjg-xg7g"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-255","url":"https://osv.dev/vulnerability/PYSEC-2022-255"}],"summary":"There is a NULL pointer dereference vulnerability in VTK, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to der"}