CVE-2025-68463: Biopython XXE Injection Vulnerability in Bio.Entrez
Summary
CVE-2025-68463: Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez. Affects biopython versions < 1.86. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Biopython is a widely-used open-source library in Python that provides tools for biological computation. It allows users to access and manipulate biological data from various sources, including databases and web services. The library is particularly popular among bioinformaticians and researchers for its ease of use and extensive functionality. However, a vulnerability has been identified in the Bio.Entrez module, which can lead to XML External Entity (XXE) injection attacks, potentially compromising the security of applications that utilize this library.
Vulnerability Detail
The vulnerability in Biopython arises from the handling of XML documents in the Bio.Entrez module. Specifically, it allows for the inclusion of external entities in XML documents, which can be exploited by attackers to access sensitive data or perform unauthorized actions. This XXE injection can lead to data leakage, denial of service, or other malicious outcomes. The vulnerability affects versions of Biopython up to and including 1.86, making it critical for users of this library to address the issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the Bio.Entrez module for XML processing until the package is updated. Additionally, if you must use it, ensure that your XML input is sanitized and does not contain any external entities.
Conclusion
The XXE injection vulnerability in Biopython's Bio.Entrez module poses a significant risk to applications that rely on this library. Users are strongly advised to update to a patched version to protect against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for biopython →
FAQ
XXE injection is a type of attack that exploits vulnerabilities in XML parsers, allowing attackers to interfere with the processing of XML data. This can lead to unauthorized access to files, data leakage, or denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.9, indicating a moderate level of severity.
Yes, users should update to a version of Biopython that is beyond 1.86 to mitigate this vulnerability.
If you cannot update the package right away, consider using alternative methods for XML processing or ensure that your XML inputs are sanitized to prevent exploitation.
