CVE-2016-5851: XML External Entity (XXE) vulnerability in python-docx
Summary
CVE-2016-5851: Improper Restriction of XML External Entity Reference in python-docx. Affects python-docx versions < 0.8.6. Fixed in 0.8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-docx is a Python library used for creating and updating Microsoft Word (.docx) files. It provides an easy-to-use interface for manipulating various aspects of Word documents. However, versions prior to 0.8.6 are vulnerable to an XML External Entity (XXE) attack.
Vulnerability Detail
The vulnerability arises due to improper restriction of XML External Entity references. An attacker can exploit this vulnerability by crafting a malicious document that includes specially crafted XML content. When this document is processed by python-docx, it may allow the attacker to read arbitrary files on the system or conduct other malicious activities. This can lead to unauthorized access, data leakage, or even remote code execution.
How To Fix
Latest published version: 1.2.0 as of 23 Oct 2026
pip install --upgrade "python-docx==1.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.6
This is the first release that contains the fix.
pip install --upgrade "python-docx==0.8.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading python-docx is not immediately feasible, a temporary workaround is to disable external entity expansion in the XML parser used by python-docx. This can be achieved by modifying the code that processes the XML content. Here's an example of how to disable external entity expansion in python-docx:
import docx
# Disable external entity expansion
docx.opc.constants.PARSE_XML = False
# Process the document
document = docx.Document('path/to/document.docx')
# ...
Conclusion
The XML External Entity (XXE) vulnerability in python-docx versions prior to 0.8.6 can allow an attacker to conduct malicious activities, including unauthorized access, data leakage, or remote code execution. It is crucial to upgrade python-docx to version 0.8.6 or later to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for python-docx →
FAQ
python-docx is a Python library used for creating and updating Microsoft Word (.docx) files. It provides an easy-to-use interface for manipulating various aspects of Word documents.
An XML External Entity (XXE) attack is a type of vulnerability that allows an attacker to exploit the processing of XML content by including external entities. This can lead to unauthorized access, data leakage, or remote code execution.
You can check the version of python-docx installed by running the following command:
pip show python-docx
No, only versions prior to 0.8.6 are affected by this vulnerability. It is recommended to upgrade to version 0.8.6 or later to mitigate the risk.
The recommended workaround is to upgrade python-docx to the latest version. However, if upgrading is not immediately feasible, you can also consider implementing additional security measures such as input validation and sanitization to mitigate the risk.
