{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"requests-xml","cve_ids":["CVE-2020-26708"],"ecosystem":"PyPI","epss":0.00737,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-ccrc-9x59-3vc4","id":"tcs_01M5KGKVCEK7M5B3FMCNY8FMFS","modified_at":"2026-06-10T17:02:33.468793558Z","published_at":"2023-06-29T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-96","https://github.com/erinxocon/requests-xml/issues/7","https://github.com/advisories/GHSA-ccrc-9x59-3vc4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-96","url":"https://osv.dev/vulnerability/PYSEC-2023-96"}],"summary":"requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file."}