Security vulnerabilities and automated fixes for xml security issues
1 post found
A script that unpacks and parses XML from `.pptx`/`.docx`-style zip archives was importing Python's native `xml.dom.minidom`, a parser known to be vulnerable to XML External Entity (XXE) attacks. The fix swaps it for the drop-in `defusedxml.minidom` module, neutralizing the risk with a two-line import change and zero behavior changes for legitimate input.