CVE-2022-27193 json
XML External Entities Vulnerability in CVRF-CSAF-Converter
published 2022-03-15 4 y ago modified 2026-07-06 4 mo ago also GHSA-m8gq-83gh-v42v , PYSEC-2026-627 , EUVD-2022-1470
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.
Patch / fix
Exploit prediction
0.69% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AC:L/AV:L/A:L/C:H/I:N/PR:N/S:U/UI:R |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | cvrf2csaf | <1.0.0rc2 |
1.0.0rc2 |
Classification
References
-
github.com
/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-27193
advisory
-
github.com
/csaf-tools/CVRF-CSAF-Converter
package
-
pypi.org
/project/cvrf2csaf
package
-
github.com
/advisories/GHSA-m8gq-83gh-v42v
advisory
Sources
- CVE List CVE-2022-27193
- GitHub Advisory GHSA-m8gq-83gh-v42v
- NVD CVE-2022-27193
- OSV PYSEC-2026-627
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.