id: PYSEC-2026-1324
published: "2026-07-07T14:34:34.487840Z"
modified: "2026-07-07T17:24:04.006220Z"
aliases:
- CVE-2024-37388
- GHSA-hx54-pf28-7xch
summary: ebookmeta XML External Entity vulnerability
details: An XML External Entity (XXE) vulnerability in the `ebookmeta.get_metadata` function via lxml dependency allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
affected:
- package:
    name: ebookmeta
    ecosystem: PyPI
    purl: pkg:pypi/ebookmeta
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.2.8
  versions:
  - 0.10.0
  - 0.10.1
  - 0.10.2
  - 0.11.0
  - 0.11.1
  - 0.11.2
  - 0.11.5
  - "0.20"
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-37388
- type: WEB
  url: "https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335"
- type: PACKAGE
  url: https://github.com/dnkorpushov/ebookmeta
- type: PACKAGE
  url: https://pypi.org/project/ebookmeta
- type: ADVISORY
  url: https://github.com/advisories/GHSA-hx54-pf28-7xch
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N