PT-2025-51994 · Pypi+1 · Biopython+1

Hartwork + 1 · CVE-2025-68463 · Published 2025-12-18 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Biopython versions prior to 1.87

Description Bio.Entrez in Biopython allows doctype XML External Entity (XXE), which is a technique where an XML parser is tricked into processing external entities within a document type definition, potentially leading to unauthorized access to local files or server-side request forgery.

Recommendations Update to version 1.87.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-68463

GHSA-X3VF-39HJ-GXR4

OPENSUSE-SU-2026:10537-1

OPENSUSE-SU-2026:21169-1

PYSEC-2026-1221

Affected Products

Biopython

Debian

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68463.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2026-1221 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3vf-39hj-gxr4 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-68463 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21169-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68463 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10537-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68463 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-68463 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-68463 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68463 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-68463 · Security Note
• https://github.com/biopython/biopython/blob/master/NEWS.rst · Note
• https://github.com/biopython/biopython/commit/736c96f37b190732ecca9da80ad0cb9d4967214d · Note
• https://github.com/biopython/biopython/issues/5109 · Note