CVE-2018-25082 json
zwczou WeChat SDK Python to_xml xml external entity reference
published 3y ago modified 4mo ago also GHSA-h384-ph77-3699 , PYSEC-2026-572 , EUVD-2023-1022
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
Patch / fix
- pypi weixin-python 0.5.5
- wechat_sdk_python_project wechat_sdk_python 0.5.5
Is CVE-2018-25082 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | weixin-python | <0.5.5 |
0.5.5 |
Affected products
- zwczou WeChat SDK Python
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
github.com
/zwczou/weixin-python/pull/30
issue-tracking, web, patch, third-party-advisory
-
github.com
/zwczou/weixin-python/commit/e54abadc777715b6dcb545c13214d1dea63df6c9
patch, web
-
github.com
/zwczou/weixin-python/releases/tag/v0.5.5
patch, web, release-notes
-
vuldb.com
/?id.223403
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.223403
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-25082
advisory
-
github.com
/zwczou/weixin-python
package
-
pypi.org
/project/weixin-python
package
-
github.com
/advisories/GHSA-h384-ph77-3699
advisory
Sources
- CVE List CVE-2018-25082
- GitHub Advisory GHSA-h384-ph77-3699
- NVD CVE-2018-25082
- OSV PYSEC-2026-572
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.