{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.8.2"}],"component":"mei2volpiano","cve_ids":["CVE-2022-37189"],"ecosystem":"PyPI","epss":0.0144,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-6xm7-3cc5-47f9","id":"tcs_01M5KHDXVYPKQW4MDJNDSG23CQ","modified_at":"2026-07-07T11:46:05.908668016Z","published_at":"2026-07-06T08:03:32.548632Z","references":["https://osv.dev/vulnerability/PYSEC-2026-847","https://nvd.nist.gov/vuln/detail/CVE-2022-37189","https://docs.python.org/3/library/xml.html#xml-vulnerabilities","https://github.com/DDMAL/MEI2Volpiano","https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59","https://pyup.io/vulnerabilities/CVE-2022-37189/50928","https://pypi.org/project/mei2volpiano","https://github.com/advisories/GHSA-6xm7-3cc5-47f9"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-847","url":"https://osv.dev/vulnerability/PYSEC-2026-847"}],"summary":"MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)"}