CVE-2016-5851: XML External Entity (XXE) Attack in python-docx
Summary
CVE-2016-5851: python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document. Affects python-docx versions < 0.8.6. Fixed in 0.8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-docx is a Python library used for creating and updating Microsoft Word (.docx) files. It provides functionality to manipulate various elements of a Word document, such as paragraphs, tables, images, and more. However, versions prior to 0.8.6 are vulnerable to XML External Entity (XXE) attacks.
Vulnerability Detail
The vulnerability in python-docx allows context-dependent attackers to conduct XML External Entity (XXE) attacks by exploiting a flaw in the way the library handles crafted documents. An attacker can leverage this vulnerability to read arbitrary files on the system or perform other malicious actions. This can lead to unauthorized access, data leakage, or remote code execution.
How To Fix
Latest published version: 1.2.0 as of 23 Oct 2026
pip install --upgrade "python-docx==1.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.6
This is the first release that contains the fix.
pip install --upgrade "python-docx==0.8.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in python-docx (CVE-2016-5851) allows for XML External Entity (XXE) attacks, which can lead to unauthorized access, data leakage, or remote code execution. It is crucial to upgrade to version 0.8.6 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-docx →
FAQ
python-docx is a Python library used for creating and updating Microsoft Word (.docx) files. It provides an easy-to-use interface to manipulate various elements of a Word document.
An XML External Entity (XXE) attack is a type of security vulnerability that allows an attacker to exploit flaws in XML parsers. By injecting malicious XML entities, an attacker can read arbitrary files, perform remote code execution, or conduct other malicious actions.
The XXE vulnerability in python-docx can be exploited by an attacker to read arbitrary files on the system or perform other malicious actions. This can lead to unauthorized access, data leakage, or remote code execution.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to the fixed version (0.8.6) of python-docx to mitigate the risk.
You can find more information about this vulnerability in the python-docx advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/python-docx/PYSEC-2016-21.yaml
