# CVE-2025-9375: python3-xmltodict: XML Injection vulnerability in xmltodict allows Input Data Manipulation

CVE-2025-9375 is fixed in 2 products on 1 platform, first by python-xmltodict 0.11.0-1ubuntu0.1~esm1, released September 1, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-9375
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0047
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 1, 2025

## Description

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 before 0.15.1. NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | python-xmltodict Debian 12.15 (bookworm) | 0.13.0-1.1~deb12u1 | [DEBIAN-CVE-2025-9375](https://patchblox.com/security/data/fix/linux/debian-cve-2025-9375.md) | Sep 1, 2025 |
| Linux | python-xmltodict Debian 13.5 (trixie) | 0.13.0-1.1~deb13u1 | [DEBIAN-CVE-2025-9375](https://patchblox.com/security/data/fix/linux/debian-cve-2025-9375.md) | Sep 1, 2025 |
| Linux | python-xmltodict Debian 14 | 0.13.0-1.1 | [DEBIAN-CVE-2025-9375](https://patchblox.com/security/data/fix/linux/debian-cve-2025-9375.md) | Sep 1, 2025 |
| Linux | python-xmltodict Ubuntu 18.04.6 LTS (bionic) | 0.11.0-1ubuntu0.1~esm1 | [python-xmltodict 0.11.0-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-xmltodict-0.11.0-1ubuntu0.1-esm1.md) | Sep 1, 2025 |
| Linux | python-xmltodict Ubuntu 20.04 LTS (focal) | 0.12.0-1ubuntu0.1~esm1 | [python-xmltodict 0.12.0-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python-xmltodict-0.12.0-1ubuntu0.1-esm1.md) | Sep 1, 2025 |
| Linux | python-xmltodict opensuse-leap 15.6 | 0.13.0-150600.3.5.1 | [SUSE-SU-2025:03511-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03511-1.md) | Oct 9, 2025 |
| Linux | python-xmltodict sles 15.6 | 0.13.0-150600.3.5.1 | [SUSE-SU-2025:03511-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03511-1.md) | Oct 9, 2025 |
| Linux | python-xmltodict sles 15.7 | 0.13.0-150600.3.5.1 | [SUSE-SU-2025:03511-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03511-1.md) | Oct 9, 2025 |
| Linux | python3-xmltodict Ubuntu 18.04.6 LTS (bionic) | 0.11.0-1ubuntu0.1~esm1 | [python3-xmltodict 0.11.0-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-xmltodict-0.11.0-1ubuntu0.1-esm1.md) | Sep 1, 2025 |
| Linux | python3-xmltodict Ubuntu 20.04 LTS (focal) | 0.12.0-1ubuntu0.1~esm1 | [python3-xmltodict 0.12.0-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-xmltodict-0.12.0-1ubuntu0.1-esm1.md) | Sep 1, 2025 |
| Linux | python3-xmltodict Ubuntu 22.04.1 LTS (jammy) | 0.12.0-2ubuntu0.1~esm1 | [python3-xmltodict 0.12.0-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-xmltodict-0.12.0-2ubuntu0.1-esm1.md) | Sep 1, 2025 |
| Linux | python3-xmltodict Ubuntu 24.04.5 LTS (noble) | 0.13.0-1ubuntu0.24.04.1 | [python3-xmltodict 0.13.0-1ubuntu0.24.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-python3-xmltodict-0.13.0-1ubuntu0.24.04.1.md) | Sep 1, 2025 |
| Linux | python3-xmltodict Ubuntu 25.04 (plucky) | 0.13.0-1ubuntu0.25.04.1 | [python3-xmltodict 0.13.0-1ubuntu0.25.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-python3-xmltodict-0.13.0-1ubuntu0.25.04.1.md) | Jan 16, 2026 |
| Linux | python3-xmltodict Ubuntu 25.10 (questing) | 0.13.0-1ubuntu1 | [python3-xmltodict 0.13.0-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-python3-xmltodict-0.13.0-1ubuntu1.md) | Sep 1, 2025 |
| Linux | python3-xmltodict Ubuntu 26.04.1 LTS (resolute) | 0.13.0-1ubuntu1 | [python3-xmltodict 0.13.0-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-python3-xmltodict-0.13.0-1ubuntu1.md) | Sep 1, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.