CVE-2017-5992: Openpyxl XXE Vulnerability
Summary
CVE-2017-5992: Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document. Affects openpyxl versions < 2.4.1. Fixed in 2.4.1. How to fix ↓
Also tracked for
- openpyxl · Debian:11
The same CVE-2017-5992 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Openpyxl is a Python library for reading and writing Excel files. It provides functionality to create, modify, and extract data from Excel spreadsheets. The library is widely used in various Python projects and applications. However, Openpyxl versions prior to 2.4.1 are vulnerable to an XML External Entity (XXE) attack. This vulnerability allows remote attackers to exploit external entities in crafted .xlsx documents, potentially leading to unauthorized information disclosure or denial of service.
Vulnerability Detail
The vulnerability (CVE-2017-5992) in Openpyxl arises from the library's default behavior of resolving external entities. By default, Openpyxl versions prior to 2.4.1 do not properly validate and sanitize input from .xlsx files, allowing an attacker to include malicious XML entities. This can lead to various attacks, including XML eXternal Entity (XXE) attacks. An attacker can craft a specially crafted .xlsx document that, when processed by an application using Openpyxl, triggers the parsing of external entities. This can result in the disclosure of sensitive information, denial of service, or other malicious activities.
How To Fix
Latest published version: 3.1.5 as of 23 Oct 2026
pip install --upgrade "openpyxl==3.1.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.1
This is the first release that contains the fix.
pip install --upgrade "openpyxl==2.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Openpyxl XXE vulnerability (CVE-2017-5992) poses a risk to applications using Openpyxl versions prior to 2.4.1. It is crucial to upgrade to the latest version of Openpyxl to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for openpyxl →
FAQ
Openpyxl is a Python library for reading and writing Excel files. It provides functionality to create, modify, and extract data from Excel spreadsheets.
An XML External Entity (XXE) attack is a type of attack that exploits vulnerabilities in XML parsers. By including malicious XML entities, an attacker can manipulate the parsing process to disclose sensitive information, perform denial of service attacks, or execute arbitrary code.
The Openpyxl XXE vulnerability allows remote attackers to exploit external entities in crafted .xlsx documents. This can lead to unauthorized information disclosure, denial of service, or other malicious activities depending on how the application processes the malicious input.
Currently, there is no known workaround for the Openpyxl XXE vulnerability. It is recommended to upgrade to Openpyxl version 2.4.1 or later to mitigate the risk.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by the Openpyxl XXE vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file of your application.
Related vulnerabilities
Recent vulnerabilities recorded for openpyxl.
