CVE-2018-25082 json
zwczou WeChat SDK Python to_xml xml external entity reference
published 2023-03-21 3 y ago modified 2026-07-01 4 mo ago also GHSA-h384-ph77-3699 , PYSEC-2026-572 , EUVD-2023-1022
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
Patch / fix
- pypi weixin-python 0.5.5
- wechat_sdk_python_project wechat_sdk_python 0.5.5
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | weixin-python | <0.5.5 |
0.5.5 |
Affected products
- zwczou WeChat SDK Python
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
github.com
/zwczou/weixin-python/pull/30
issue-tracking, web, patch, third-party-advisory
-
github.com
/zwczou/weixin-python/commit/e54abadc777715b6dcb545c13214d1dea63df6c9
patch, web
-
github.com
/zwczou/weixin-python/releases/tag/v0.5.5
patch, web, release-notes
-
vuldb.com
/?id.223403
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.223403
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-25082
advisory
-
github.com
/zwczou/weixin-python
package
-
pypi.org
/project/weixin-python
package
-
github.com
/advisories/GHSA-h384-ph77-3699
advisory
Sources
- CVE List CVE-2018-25082
- GitHub Advisory GHSA-h384-ph77-3699
- NVD CVE-2018-25082
- OSV PYSEC-2026-572
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.