Arbitrary File Read Vulnerability in xml2rfc: A Security Concern
Summary
GHSA-9mv7-3c64-mmqw: xml2rfc is vulnerable to arbitrary file reads through prepped files. Affects xml2rfc versions < 3.30.2. Fixed in 3.30.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xml2rfc is a Python package used for generating RFC documents in various formats, including PDF. It allows users to create and manipulate RFCXML, which is essential for the Internet Engineering Task Force (IETF) standards process. However, a security vulnerability has been identified that could allow unauthorized access to the filesystem, posing a significant risk to users who process untrusted input.
Vulnerability Detail
The vulnerability arises from improper handling of link elements in RFCXML when generating PDF files. An attacker can inject malicious link elements, which can lead to arbitrary file reads from the filesystem. This could expose sensitive information and compromise the integrity of the system. The vulnerability is classified under CWE-22, indicating a potential for path traversal attacks.
How To Fix
Latest published version: 3.34.1 as of 23 Oct 2026
pip install --upgrade "xml2rfc==3.34.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.30.2
This is the first release that contains the fix.
pip install --upgrade "xml2rfc==3.30.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is recommended to validate untrusted input containing link elements with rel="attachment" before processing. This can help prevent the execution of malicious links. For example, you can implement a check in your code like this:
if 'rel="attachment"' in link_element:
# Process the link element safely
else:
# Reject or sanitize the input
Conclusion
The xml2rfc package has a significant vulnerability that allows for arbitrary file reads through malicious link elements. Users are strongly advised to update to the latest version and implement input validation to mitigate risks. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for xml2rfc →
FAQ
The vulnerability allows attackers to read arbitrary files from the filesystem by injecting malicious link elements into RFCXML.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the xml2rfc package to version 3.30.2 or later to patch the vulnerability and validate untrusted input before processing.
If exploited, this vulnerability could lead to unauthorized access to sensitive files, compromising the security of the system.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for xml2rfc.
