{"id":"CVE-2022-37189","aliases":["GHSA-6xm7-3cc5-47f9","PYSEC-2026-847"],"title":"MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)","summary":"MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"mei2volpiano","product":"mei2volpiano","ecosystem":"pip","affected":["mei2volpiano <= 0.8.2"],"published":"2022-09-08","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6xm7-3cc5-47f9","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37189"},{"url":"https://docs.python.org/3/library/xml.html#xml-vulnerabilities"},{"url":"https://github.com/DDMAL/MEI2Volpiano"},{"url":"https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59"},{"url":"https://pyup.io/vulnerabilities/CVE-2022-37189/50928"}],"tags":["osv","pip"],"epss":0.01376,"epssPercentile":0.70846,"ingestedAt":"2026-07-08T18:25:46.564Z","slug":"CVE-2022-37189","body":"## Overview\n\nDDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.\n\n## Affected packages\n\n- `mei2volpiano <= 0.8.2`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}