---
id: CVE-2024-37388
aliases:
  - GHSA-hx54-pf28-7xch
  - PYSEC-2026-1324
title: ebookmeta XML External Entity vulnerability
summary: ebookmeta XML External Entity vulnerability
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
vendor: ebookmeta
product: ebookmeta
ecosystem: pip
affected:
  - ebookmeta < 1.2.8
patched:
  - ebookmeta 1.2.8
published: '2024-06-07'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hx54-pf28-7xch'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-37388'
  - url: 'https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335'
  - url: 'https://github.com/dnkorpushov/ebookmeta'
tags:
  - osv
  - pip
epss: 0.00536
epssPercentile: 0.4272
ingestedAt: '2026-07-08T18:25:50.341Z'
---

## Overview

An XML External Entity (XXE) vulnerability in the `ebookmeta.get_metadata` function via lxml dependency allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.

## Affected packages

- `ebookmeta < 1.2.8`

## Remediation

Upgrade to a patched release:

- `ebookmeta 1.2.8`