Security vulnerabilities and automated fixes for xxe issues
1 post found
A critical XML External Entity (XXE) vulnerability was discovered in `scripts/screenshots/ui.py` where the native Python `xml.etree.ElementTree` library was used without XXE protections. The fix replaces the vulnerable import with `defusedxml.ElementTree`, which disables external entity processing by default and prevents attackers from exploiting XML parsing to access sensitive files or execute denial-of-service attacks.