What’s Vulnerable › Vulnerabilities

CVE-2021-29421

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-01 · updated 2026-06-17
• Weakness: CWE-611

Description

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.

Affected products

• Fedoraproject Fedora: 32, 33
• Pikepdf Project Pikepdf: from 1.3.0 through 2.9.2

References

• https://github.com/pikepdf/pikepdf/blob/v2.10.0/docs/release_notes.rst#v2100
• https://github.com/pikepdf/pikepdf/commit/3f38f73218e5e782fe411ccbb3b44a793c0b343a
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36P4HTLBJPO524WMQWW57N3QRF4RFSJG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QFLBBYGEDNXJ7FS6PIWTVI4T4BUPGEQ/
• https://github.com/pikepdf/pikepdf/blob/v2.10.0/docs/release_notes.rst#v2100
• https://github.com/pikepdf/pikepdf/commit/3f38f73218e5e782fe411ccbb3b44a793c0b343a
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36P4HTLBJPO524WMQWW57N3QRF4RFSJG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QFLBBYGEDNXJ7FS6PIWTVI4T4BUPGEQ/

Get alerted when CVE-2021-29421 or the next vulnerability affects your stack