What’s Vulnerable › Vulnerabilities

CVE-2022-37189

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-07 · updated 2026-06-17
• Weakness: CWE-611

Description

DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.

Affected products

• Ddmal Mei2Volpiano: through 0.8.2

References

• https://docs.python.org/3/library/xml.html#xml-vulnerabilities
• https://github.com/DDMAL/MEI2Volpiano/
• https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59
• https://pyup.io/vulnerabilities/CVE-2022-37189/50928/
• https://docs.python.org/3/library/xml.html#xml-vulnerabilities
• https://github.com/DDMAL/MEI2Volpiano/
• https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59
• https://pyup.io/vulnerabilities/CVE-2022-37189/50928/

Get alerted when CVE-2022-37189 or the next vulnerability affects your stack