GitHub Advisoryadvisory · PyPI

GHSA-4q2r-qxp6-h5j6 Improper Restriction of XML External Entity Reference in Quokka

CRITICAL Published 2021-08-30 Modified 2024-10-16 Official page ↗

Aliases: CVE-2020-18705
Ecosystem: PyPI
Packages: quokka
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-611
Reviewed: 2021-08-26

Affected packages

• PyPI quokka: <= 0.4.0 (no fix yet)

Description

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'.

Related

Alias · CVE (1)

CVE-2020-18705 XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component… vulnerability

Weakness · CWE (1)

CWE-611 Improper Restriction of XML External Entity Reference weakness

References