{"action":"Upgrade mpxj to 16.4.1 or later.","affected":[{"fixed":"16.4.1","introduced":"5.5.5"}],"component":"mpxj","cve_ids":["CVE-2026-61570"],"ecosystem":"PyPI","epss":0.00474,"exploited":false,"fixed_versions":["16.4.1"],"ghsa_id":"GHSA-5vvx-3h34-f3gj","id":"tcs_01M5KH9YM99CGVMC6A6YJSXFC1","modified_at":"2026-10-01T17:45:09.329795783Z","published_at":"2026-10-01T16:38:34.612479Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4107","https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj","https://github.com/joniles/mpxj/commit/6e8288bc4d1cd62842af298004dc74fe66fb0805","https://github.com/joniles/mpxj","https://github.com/joniles/mpxj/releases/tag/v16.4.1","https://pypi.org/project/mpxj","https://github.com/advisories/GHSA-5vvx-3h34-f3gj","https://nvd.nist.gov/vuln/detail/CVE-2026-61570"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-4107","url":"https://osv.dev/vulnerability/PYSEC-2026-4107"}],"summary":"MPXJ: XXE Vulnerability in MerlinReader"}