CVE-2020-18703

Description

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.

How to fix CVE-2020-18703

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• PyPI/quokka—no fix listed
• —no fix listed

Is CVE-2020-18703 being exploited?

Low — EPSS is 2.8%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, <= 0.4.0
• from 0

CVSS scores

References (5)

• ADVISORYgithub.com/advisories/GHSA-3xg5-6c3j-vp8x
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-18703
• PATCHgithub.com/quokkaproject/quokka
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/quokka/PYSEC-2021-144.yaml
• WEB